D-095 RESOLVED. User provided fresh root credentials in .env.secrets;
the run resumed and applied the IAM baseline against account
581513795199.
Live actions (2026-07-28):
1. Converted spike_runner_policy.json from an inline user policy to a
customer-managed policy acdl-spike-runner-policy (ARN
arn:aws:iam::581513795199:policy/acdl-spike-runner-policy). The
extended policy (5917 bytes) exceeded the 2048-byte inline limit;
the managed-policy path supports 6144 bytes per version + 5
versions. Inline policy deleted; managed policy attached.
2. Re-created the acdl-act-runner-role OIDC role (CAP-022 — was gone
since Phase 08). Trust policy permits root assume until
go-gitea/gitea#36988 merges real OIDC federation. Same managed
policy attached so the runner inherits spike-runner-equivalent
permissions, no long-lived key needed.
Grant verification (all OK):
- cloudfront:ListDistributions — OK (0 items, stacks not yet deployed)
- wafv2:ListWebAcls(CLOUDFRONT) — OK
- lambda:ListFunctions — OK
- dynamodb:DescribeTable(acdl-contracts) — ResourceNotFound (table not
yet created — Phase 57 applies it; grant works, no AccessDenied)
- ce:GetCostAndUsage (7-day window) — OK (7 results — Phase 59 queries
the full window)
- secretsmanager:ListSecrets — OK
- sns:ListTopics — OK
- iam:GetRole(acdl-act-runner-role) — OK
terraform/bootstrap/apply_iam_baseline.py — new idempotent script that
records the live step (create/version managed policy, attach to user +
role, delete leftover inline, ensure runner role). Re-ran to confirm
idempotency (created v2, deleted v1).
.ciagent/IAM_POLICY.md — updated with the managed-policy note, the
OIDC role ARN + trust policy, the grant verification table, and the
D-095 resolution note.
terraform/bootstrap/README.md — added the v1.11 Phase 56 section
documenting apply_iam_baseline.py.
Baseline test: 15/15 pass.
---ci---
project: acdl
phase: 56
milestone: v1.11
status: execute
escalation:
type: deploy
id: D-095
status: resolved
resolved_at: 2026-07-28
resolution: user provided fresh root credentials in .env.secrets;
managed policy applied + OIDC role re-created
---/ci---
Jon Chery