--allow-region stringArray a region these identities may act in; repeatable (default: --region alone)
--artifact-key string KMS key ARN protecting sealed artifacts; the runner writes it, the unsealer reads it
--ci-role string GitHub OIDC role that builds the plane's own cluster on day zero (trust policy only)
--external-id string binds a target-account role to one tenant (trust policy only)
-h, --help help for policy
--hosted-zone string Route53 zone the build may publish records in
--identity string which identity: a name from --list; or trust, the build role's trust policy; tenant-sealer-trust / tenant-unsealer-trust, the trust on the tenant's artifact roles; or boundary, the cap every Kubox role carries
--list list the identities and what each one is for
--operator stringArray ARN of a user or role that may assume the build role directly, for a laptop build; repeatable (trust policy only)
--plane-account string AWS account the management plane runs in
--region string primary region, substituted into resource ARNs
--stack-key string KMS key ARN protecting the Pulumi checkpoint; the build both writes and reads it
--state-backend string Pulumi state backend, e.g. s3://bucket/prefix
--target-account string AWS account a cluster is built into (default: the plane's own)
--tenant stringArray a tenant the artifact roles seal for: the cloud connection's namespace (kubox-system for Kubox's own account); repeatable, and required for the tenant artifact identities
--workload-issuer string the identity plane's issuer, e.g. https://oidc-exp.kubox.cloud; required
