CAIP Workflows FAQ
Answers to the things that most often trip up workflow authors: what a run executes as, why a new stage can break identity, cross-account access, and where to find metrics and logs.
Identity & Stages
What identity does my run use?
A Workflow Run runs as an execution context CAIP provisions per space and stage:
| Element | Value |
|---|---|
| Namespace | {spaceId}-{stage} |
| Service account | {spaceId}-{stage}-sa |
| AWS execution role | attached to the service account |
| Shared storage | {spaceId}-{stage}-shared-storage |
A run in a space on prod executes in namespace {space-id}-prod, with an AWS role scoped to that namespace. The run gets only what its execution role grants.
Why does my run fail with 403 after promoting to a new stage?
Stages (test, int, e2e, prod) are separate execution contexts, each has its own namespace, service account, and role. Promoting a version to a new stage doesn't carry the old stage's identity over.
Check:
- The stage assignment exists for the target stage.
- The role and service account are provisioned for that stage.
- The CAIP GitHub App is installed for any repo the workflow clones, see Installing the GitHub App.
Cross-Account Access
Why can't my task read S3 / Glue / CDH in another AWS account?
The run uses its execution role, which lives in your CAIP AWS account and has no access in the external account by default. The bridge is role chaining: let the execution role sts:AssumeRole into a read-only role in the external account, short-lived credentials, no static keys.
See Cross Account Read Access for the two-sided setup.
My task fails with AccessDenied or an sts:AssumeRole error
The cross-account setup is missing or incomplete, the execution role isn't allowed to assume the external role, or the external role's trust policy doesn't include your execution role. Follow the Cross Account Read Access guide, then validate from a run.
Metrics & Logs
Where can I see my run's metrics?
In the per-space Grafana:
https://workflows.prod.caip.api.orbit.region.aws.cloud.bmw/v1/spaces/{spaceId}/metrics
See Metrics & Logs for more details.
How do I inspect a run's logs?
- Grafana → Explore → Workflow API Logs → query by
runId. - API —
GET /v1/spaces/{spaceId}/workflows/{workflowId}/runs/{runId}returns the run status and per-task breakdown. See Runs.
My run is Failed and I don't know why
Check the step logs first (Grafana Explore → Workflow API Logs → runId), or fetch the run via the API for the per-task status breakdown. If a worker pod is stuck Pending / ImagePullBackOff, check the pending pods panel in Grafana for the reason.
Raise an Incident or ask in the CAIP Community Teams channel.