Commit

Arco v0.11 is out 🔐 If you haven’t seen it yet: Arco is an open-source CLI that deploys Laravel to AWS Lambda Web Functions. It uses FrankenPHP with Octane workers, so you manage no servers, and you deploy with one command: arco deploy. The deploy profile can create IAM roles and run code, and that power is admin-equivalent. When you hand it to CI or a deploy service, you want a hard ceiling on it. This release adds one. Permissions boundary (opt-in) ->permissionsBoundary('arn:aws:iam::123456789012:policy/arco-boundary') Or set it from CI without touching arco.php: ARCO_PERMISSIONS_BOUNDARY=arn:... vendor/bin/arco deploy The execution role Arco creates always carries the boundary. Arco never removes one. If the account refuses the role, the deploy stops before any function changes. The docs include: Account guard: the exact IAM statements an account owner adds, so roles can only be created with the boundary. Bypass list: the other paths that must also be closed, such as Lambda writes outside the app and old unbounded roles. Recommended boundary policy: built from what Arco actually grants at runtime. Also in this release: 🧹 PHP warnings now always go to stderr, so --json output on stdout stays clean. ✅ Verified with a real deploy on AWS: the role came back from IAM with its boundary. composer require --dev multiapi/arco:^0.11