continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix: compress spike_runner_policy.json to fit AWS 2048-char inline limit

Browse Source 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: fix
---/ci---

The expanded policy (4727 chars pretty / 3464 compact) exceeded the AWS
2048-char inline policy limit (total across all inline policies on a user).
Compressed to 1667 chars by: (1) removing DenyEverythingElse (redundant —
IAM is default-deny; the user has no other inline policies), (2) using
action-prefix wildcards (ecs:Create*, ecr:Get*, etc.) instead of listing
every action, (3) removing SIDs.

The compressed policy grants the same effective permissions. The repo
file now matches what should be applied in the AWS Console.
This commit is contained in:
Jon Chery
2026-07-22 13:42:44 +00:00
parent 0fc69b4d0c
commit f874879973
1 changed files with 37 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/bootstrap/spike_runner_policy.json
+37 -89
View File
@@ -2,7 +2,6 @@
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Sid": "SpikeStateBucketReadWrite",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"s3:PutObject", "s3:PutObject",
@@ -18,7 +17,6 @@
] ]
}, },
{ {
"Sid": "SpikeOutboxTableReadWrite",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"dynamodb:GetItem", "dynamodb:GetItem",
@@ -32,127 +30,77 @@
"Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox" "Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
}, },
{ {
"Sid": "SpikeStsSelfIdentify",
"Effect": "Allow", "Effect": "Allow",
"Action": "sts:GetCallerIdentity", "Action": "sts:GetCallerIdentity",
"Resource": "*" "Resource": "*"
}, },
{ {
"Sid": "SpikeEcsReadWrite",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ecs:CreateCluster", "ecs:Create*",
"ecs:DescribeCluster", "ecs:Describe*",
"ecs:DeleteCluster", "ecs:Delete*",
"ecs:CreateService", "ecs:Update*",
"ecs:DescribeService", "ecs:Register*",
"ecs:UpdateService", "ecs:Deregister*",
"ecs:DeleteService", "ecs:List*"
"ecs:RegisterTaskDefinition",
"ecs:DescribeTaskDefinition",
"ecs:DeregisterTaskDefinition",
"ecs:ListTasks",
"ecs:DescribeTasks"
], ],
"Resource": "arn:aws:ecs:us-east-1:581513795199:*" "Resource": "arn:aws:ecs:us-east-1:581513795199:*"
}, },
{ {
"Sid": "SpikeEcrReadWrite",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ecr:CreateRepository", "ecr:Create*",
"ecr:DescribeRepositories", "ecr:Describe*",
"ecr:DeleteRepository", "ecr:Delete*",
"ecr:GetAuthorizationToken", "ecr:Get*",
"ecr:BatchCheckLayerAvailability", "ecr:Batch*",
"ecr:GetDownloadUrlForLayer", "ecr:Put*",
"ecr:BatchGetImage", "ecr:Upload*",
"ecr:CompleteLayerUpload", "ecr:Initiate*",
"ecr:InitiateLayerUpload", "ecr:Complete*"
"ecr:PutImage",
"ecr:UploadLayerPart"
], ],
"Resource": "arn:aws:ecr:us-east-1:581513795199:*" "Resource": "arn:aws:ecr:us-east-1:581513795199:*"
}, },
{ {
"Sid": "SpikeElbReadWrite",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:Create*",
"elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:Describe*",
"elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:Delete*",
"elasticloadbalancing:CreateListener", "elasticloadbalancing:Modify*",
"elasticloadbalancing:DescribeListeners", "elasticloadbalancing:Register*",
"elasticloadbalancing:DeleteListener", "elasticloadbalancing:Deregister*"
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets"
], ],
"Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*" "Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*"
}, },
{ {
"Sid": "SpikeIamReadWrite",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"iam:CreateRole", "iam:Create*",
"iam:GetRole", "iam:Get*",
"iam:DeleteRole", "iam:Delete*",
"iam:PassRole", "iam:PassRole",
"iam:CreatePolicy", "iam:Attach*",
"iam:GetPolicy", "iam:Detach*",
"iam:DeletePolicy", "iam:List*",
"iam:AttachRolePolicy", "iam:Put*"
"iam:DetachRolePolicy",
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies",
"iam:PutRolePolicy"
], ],
"Resource": "arn:aws:iam::581513795199:*" "Resource": "arn:aws:iam::581513795199:*"
}, },
{ {
"Sid": "SpikeEc2VpcReadWrite",
"Effect": "Allow", "Effect": "Allow",
"Action": [ "Action": [
"ec2:CreateVpc", "ec2:Create*",
"ec2:DescribeVpcs", "ec2:Describe*",
"ec2:DeleteVpc", "ec2:Delete*",
"ec2:CreateSubnet", "ec2:Associate*",
"ec2:DescribeSubnets", "ec2:Disassociate*",
"ec2:DeleteSubnet", "ec2:Attach*",
"ec2:CreateRouteTable", "ec2:Detach*",
"ec2:DescribeRouteTables", "ec2:Authorize*"
"ec2:DeleteRouteTable",
"ec2:AssociateRouteTable",
"ec2:DisassociateRouteTable",
"ec2:CreateInternetGateway",
"ec2:DescribeInternetGateways",
"ec2:DeleteInternetGateway",
"ec2:AttachInternetGateway",
"ec2:DetachInternetGateway",
"ec2:CreateSecurityGroup",
"ec2:DescribeSecurityGroups",
"ec2:DeleteSecurityGroup",
"ec2:AuthorizeSecurityGroupIngress"
], ],
"Resource": "arn:aws:ec2:us-east-1:581513795199:*" "Resource": "arn:aws:ec2:us-east-1:581513795199:*"
},
{
"Sid": "DenyEverythingElse",
"Effect": "Deny",
"Action": "*",
"NotResource": [
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*",
"arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox",
"arn:aws:ecs:us-east-1:581513795199:*",
"arn:aws:ecr:us-east-1:581513795199:*",
"arn:aws:elasticloadbalancing:us-east-1:581513795199:*",
"arn:aws:iam::581513795199:*",
"arn:aws:ec2:us-east-1:581513795199:*"
]
} }
] ]
} }