Dashboard

A thin web UI over the same control plane as the CLI — same tags, same destroy rules, same “say what AWS will do” confirms.

Defaults we picked

Choice	Default	Notes
Auth	Clerk	Set VITE_CLERK_PUBLISHABLE_KEY at build. Without it, local/CI use a demo session.
Host	Cloudflare Pages (awsdream-dashboard)	Separate from docs Pages.
API	Bun control-plane (bun run dashboard:api)	Assumes a customer IAM role — no long-lived access keys.

Connect your AWS account

1. Sign in (Clerk, or demo locally).
2. Open Connect → launch the CloudFormation quick-create link.
3. Wait for CREATE_COMPLETE.
4. Paste RoleArn + ExternalId from stack outputs.
5. Inventory shows utopia-tagged bucket / secret / fn with a cost column ($… from Cost Explorer or COST_UNAVAILABLE).

Template (also under docs): /templates/utopia-control-plane-role.yaml.

Guardrails (same as CLI)

• Creates always set utopia:project + utopia:env
• Destroy defaults to current project+env; force is an explicit checkbox
• Confirm modals name the real AWS consequence; Cancel does not call the API
• Preview = dry-run before mutate
• Errors show {hint} — no stack dumps
• Secrets stay *** until you deliberately reveal

Local dev

bun run dashboard:api          # http://localhost:8787
bun run dashboard:dev          # http://localhost:5173 (proxies /api)

Deploy

bun run dashboard:deploy       # Pages project awsdream-dashboard
bun run docs:deploy            # keeps the CFN template on docs Pages

Set UTOPIA_CONTROL_PLANE_PRINCIPAL_ARN on the API so the customer role trust matches your control-plane principal.