Add R2 ECS CloudFormation template

[westrik]

No description provided.

[greptile-apps]

Confidence Score: 5/5  · 

• The template is safe to merge as a new infrastructure addition; it does not modify any existing resources and all previously flagged blocking issues have been corrected in this version.
• Every finding from prior review threads has been addressed: sandbox secrets now flow through Secrets Manager, SQS permissions are conditional and correctly scoped, the RDS security group uses source-SG ingress, the license key is parameterized, and the IAM policy YAML structure is correct. The remaining findings are hardening items — over-permissioned task roles for Temporal services and the proxy, a single-AZ primary RDS instance, and the dual representation of seccomp profiles that could drift silently — none of which block correct operation of the stack on first deploy.
• cloudformation/retool-r2.ec2.yaml warrants the most attention, particularly the IAM task-role assignments for Temporal services and the proxy, and the RDS instance configuration.

Important Files Changed

Filename	Overview
cloudformation/retool-r2.ec2.yaml	Large new CloudFormation template (2263 lines) adding R2 agent sandbox infrastructure on ECS-on-EC2. Addresses all previously flagged issues (sandbox secrets now use Secrets Manager, SQS scoped to queue ARN and conditioned on watcher flag, RDS ingress scoped by security group, license key parameterized, IAM policy YAML structure corrected). New P2 findings: Temporal/proxy task definitions share RetoolTaskRole gaining unneeded S3 permissions; RetoolRDSInstance is single-AZ with no backup retention override; embedded seccomp blobs in UserData can silently diverge from the JSON source files in the repo.
cloudformation/README.md	Adds detailed documentation for the new retool-r2.ec2.yaml template covering architecture, prerequisites, key parameters, browser routing design, AMI/AppArmor notes, deploy commands, and validation strategy. Well-structured and accurate relative to the template.
cloudformation/gvisor-seccomp.json	gVisor seccomp profile used by the sandbox task definition on sandbox hosts. Added as a standalone JSON file alongside the base64-compressed version embedded in the sandbox launch template UserData; the two must stay in sync manually.
cloudformation/nsjail-seccomp.json	nsjail seccomp profile for the js-executor service on platform hosts. Same dual-representation concern as gvisor-seccomp.json — the JSON source and the embedded base64 blob in the platform launch template UserData must be kept in sync manually.

_{Reviews (5): Last reviewed commit: "Add R2 ECS CloudFormation template" | Re-trigger Greptile}