Get AWS delegated-grant setup artifacts
Generates the AWS delegated-grant onboarding artifacts for an AWS-sink subscription (sqs, eventbridge): the cross-account IAM trust policy and a CloudFormation quick-create console link the customer applies in their own AWS account to create the delivery role Streaming Hub assumes. On first fetch a non-secret sts:ExternalId correlation value is minted and embedded in both artifacts; a re-fetch reuses it (stable artifacts). No AWS credential is ever stored or returned — the role is assumed per delivery, guarded by the ExternalId condition. A non-AWS sink returns 422 validation_error.
Authorizations
A bearer JWT issued by plugin-auth (lib-auth). The tenant identity is resolved from the validated token claims; the /v1 surface never reads a tenant from the body, path, or query. Machine callers obtain a token via the plugin-auth client-credentials flow. The /admin surface authorizes against an operator scope and carries no tenant context.
Path Parameters
The unique identifier of the subscription (UUIDv7).
Response
The delegated-grant artifacts.
The non-secret sts:ExternalId correlation value pinned into the trust policy (minted once, stable across re-fetches).
"0190a1b2-c3d4-7e5f-8a9b-0c1d2e3f4a5b"
The AWS region the artifacts target.
"us-east-1"
The cross-account IAM trust policy JSON (as a string) the customer applies in their AWS account.
"{ \"Version\": \"2012-10-17\", \"Statement\": [] }"
A CloudFormation quick-create console link that provisions the delivery role.
"https://us-east-1.console.aws.amazon.com/cloudformation/home?..."

