Uploaded files in a BAM-owned AWS account
Date: 2026-10-30 · Status: Accepted
Context
Section titled “Context”BA’s uploaded documents sat in a bucket in the Sii management account. BAM may one day split from TEP, so its resources should sit under their own organisational unit with their own accounts.
Decision
Section titled “Decision”A new AWS member account bam-staging in the BAM organisational unit of the Sii organisation (the unit was renamed from BAM Dev), set up like tep-production: a root distribution list that accepts outside mail, an Entra administrators group, a region guardrail. bam-production later. The old bucket is deleted after cut-over.
Consequences
Section titled “Consequences”The bucket ba-staging-documents lives in the new account, created by the aws layer of ba-infrastructure. CI assumes the role ba-terraform-ci in the management account with GitHub OIDC and steps into the member account from there. The API uses an IAM user with Get and Put on the bucket only; its access key goes from aws iam create-access-key straight into the vault.