From f874879973e0f5881a5308ef8ff10c84e0f30eed Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Wed, 22 Jul 2026 13:42:44 +0000 Subject: [PATCH] fix: compress spike_runner_policy.json to fit AWS 2048-char inline limit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ---ci--- project: acdl phase: 0 milestone: v1.2 status: fix ---/ci--- The expanded policy (4727 chars pretty / 3464 compact) exceeded the AWS 2048-char inline policy limit (total across all inline policies on a user). Compressed to 1667 chars by: (1) removing DenyEverythingElse (redundant — IAM is default-deny; the user has no other inline policies), (2) using action-prefix wildcards (ecs:Create*, ecr:Get*, etc.) instead of listing every action, (3) removing SIDs. The compressed policy grants the same effective permissions. The repo file now matches what should be applied in the AWS Console. --- terraform/bootstrap/spike_runner_policy.json | 126 ++++++------------- 1 file changed, 37 insertions(+), 89 deletions(-) diff --git a/terraform/bootstrap/spike_runner_policy.json b/terraform/bootstrap/spike_runner_policy.json index 5675ed5..1f1812e 100644 --- a/terraform/bootstrap/spike_runner_policy.json +++ b/terraform/bootstrap/spike_runner_policy.json @@ -2,7 +2,6 @@ "Version": "2012-10-17", "Statement": [ { - "Sid": "SpikeStateBucketReadWrite", "Effect": "Allow", "Action": [ "s3:PutObject", @@ -18,7 +17,6 @@ ] }, { - "Sid": "SpikeOutboxTableReadWrite", "Effect": "Allow", "Action": [ "dynamodb:GetItem", @@ -32,127 +30,77 @@ "Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox" }, { - "Sid": "SpikeStsSelfIdentify", "Effect": "Allow", "Action": "sts:GetCallerIdentity", "Resource": "*" }, { - "Sid": "SpikeEcsReadWrite", "Effect": "Allow", "Action": [ - "ecs:CreateCluster", - "ecs:DescribeCluster", - "ecs:DeleteCluster", - "ecs:CreateService", - "ecs:DescribeService", - "ecs:UpdateService", - "ecs:DeleteService", - "ecs:RegisterTaskDefinition", - "ecs:DescribeTaskDefinition", - "ecs:DeregisterTaskDefinition", - "ecs:ListTasks", - "ecs:DescribeTasks" + "ecs:Create*", + "ecs:Describe*", + "ecs:Delete*", + "ecs:Update*", + "ecs:Register*", + "ecs:Deregister*", + "ecs:List*" ], "Resource": "arn:aws:ecs:us-east-1:581513795199:*" }, { - "Sid": "SpikeEcrReadWrite", "Effect": "Allow", "Action": [ - "ecr:CreateRepository", - "ecr:DescribeRepositories", - "ecr:DeleteRepository", - "ecr:GetAuthorizationToken", - "ecr:BatchCheckLayerAvailability", - "ecr:GetDownloadUrlForLayer", - "ecr:BatchGetImage", - "ecr:CompleteLayerUpload", - "ecr:InitiateLayerUpload", - "ecr:PutImage", - "ecr:UploadLayerPart" + "ecr:Create*", + "ecr:Describe*", + "ecr:Delete*", + "ecr:Get*", + "ecr:Batch*", + "ecr:Put*", + "ecr:Upload*", + "ecr:Initiate*", + "ecr:Complete*" ], "Resource": "arn:aws:ecr:us-east-1:581513795199:*" }, { - "Sid": "SpikeElbReadWrite", "Effect": "Allow", "Action": [ - "elasticloadbalancing:CreateLoadBalancer", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DeleteLoadBalancer", - "elasticloadbalancing:CreateListener", - "elasticloadbalancing:DescribeListeners", - "elasticloadbalancing:DeleteListener", - "elasticloadbalancing:CreateTargetGroup", - "elasticloadbalancing:DescribeTargetGroups", - "elasticloadbalancing:DeleteTargetGroup", - "elasticloadbalancing:ModifyTargetGroupAttributes", - "elasticloadbalancing:RegisterTargets", - "elasticloadbalancing:DeregisterTargets" + "elasticloadbalancing:Create*", + "elasticloadbalancing:Describe*", + "elasticloadbalancing:Delete*", + "elasticloadbalancing:Modify*", + "elasticloadbalancing:Register*", + "elasticloadbalancing:Deregister*" ], "Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*" }, { - "Sid": "SpikeIamReadWrite", "Effect": "Allow", "Action": [ - "iam:CreateRole", - "iam:GetRole", - "iam:DeleteRole", + "iam:Create*", + "iam:Get*", + "iam:Delete*", "iam:PassRole", - "iam:CreatePolicy", - "iam:GetPolicy", - "iam:DeletePolicy", - "iam:AttachRolePolicy", - "iam:DetachRolePolicy", - "iam:ListRolePolicies", - "iam:ListAttachedRolePolicies", - "iam:PutRolePolicy" + "iam:Attach*", + "iam:Detach*", + "iam:List*", + "iam:Put*" ], "Resource": "arn:aws:iam::581513795199:*" }, { - "Sid": "SpikeEc2VpcReadWrite", "Effect": "Allow", "Action": [ - "ec2:CreateVpc", - "ec2:DescribeVpcs", - "ec2:DeleteVpc", - "ec2:CreateSubnet", - "ec2:DescribeSubnets", - "ec2:DeleteSubnet", - "ec2:CreateRouteTable", - "ec2:DescribeRouteTables", - "ec2:DeleteRouteTable", - "ec2:AssociateRouteTable", - "ec2:DisassociateRouteTable", - "ec2:CreateInternetGateway", - "ec2:DescribeInternetGateways", - "ec2:DeleteInternetGateway", - "ec2:AttachInternetGateway", - "ec2:DetachInternetGateway", - "ec2:CreateSecurityGroup", - "ec2:DescribeSecurityGroups", - "ec2:DeleteSecurityGroup", - "ec2:AuthorizeSecurityGroupIngress" + "ec2:Create*", + "ec2:Describe*", + "ec2:Delete*", + "ec2:Associate*", + "ec2:Disassociate*", + "ec2:Attach*", + "ec2:Detach*", + "ec2:Authorize*" ], "Resource": "arn:aws:ec2:us-east-1:581513795199:*" - }, - { - "Sid": "DenyEverythingElse", - "Effect": "Deny", - "Action": "*", - "NotResource": [ - "arn:aws:s3:::acdl-tfstate-581513795199-us-east-1", - "arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*", - "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox", - "arn:aws:ecs:us-east-1:581513795199:*", - "arn:aws:ecr:us-east-1:581513795199:*", - "arn:aws:elasticloadbalancing:us-east-1:581513795199:*", - "arn:aws:iam::581513795199:*", - "arn:aws:ec2:us-east-1:581513795199:*" - ] } ] } \ No newline at end of file