2 Commits

Author	SHA1	Message	Date
Jon Chery	d28630d1f1	phase: 8, status: plan-as-execute, persona: lead-developer, task: T-8.8 ... ---ci--- project: acdl phase: 8 milestone: v1.1 status: plan-as-execute persona: lead-developer task: T-8.8 requirements.covered: [REQ-23] ---/ci--- Wave 5: execute the bootstrap against real AWS + fix verify script. - Created S3 bucket acdl-tfstate-581513795199-us-east-1 (versioning enabled) + DynamoDB table acdl-outbox (PAY_PER_REQUEST, PK contractId, SK eventType#eventTs) via create_state_backend.py. - Created IAM user acdl-spike-runner + scoped inline policy (DenyEverythingElse) + initial key via create_iam_user.py. - Rotated the spike key via rotate_spike_key.sh: old key deleted, new key in gitignored .env.secrets (chmod 600). - verify_phase08.sh fixes: (a) heredoc python instead of -c to avoid bash quoting issues; (b) Check 4 uses the bootstrap root key to inspect IAM (the spike key is least-privilege and cannot iam:GetUser - that itself confirms the policy denies non-granted actions); (c) get_user_policy returns PolicyDocument as a dict, not a URL-encoded string in this boto3 version - handle both. - VERIFIED: caller identity is acdl-spike-runner (not root), S3 + DDB + IAM user + Deny-everything-else policy all present, .env.secrets + .bootstrap_state.json gitignored. D-034 closure: user must manually rotate the root key in the AWS IAM console now (the bootstrap root key has served its one-shot purpose).	2026-07-21 19:01:58 +00:00
Jon Chery	1d5c4d2ae7	phase: 8, status: plan-as-execute, persona: platform-engineer+lead-developer, task: T-8.5..T-8.7 ... ---ci--- project: acdl phase: 8 milestone: v1.1 status: plan-as-execute persona: platform-engineer+lead-developer task: [T-8.5, T-8.6, T-8.7] requirements.covered: [REQ-23] ---/ci--- Waves 3+4: rotation script + verify script + README + .gitignore. - T-8.5 (platform): scripts/rotate_spike_key.sh - boto3 with bootstrap root key from env (ACDL_BOOTSTRAP_AWS_*); creates new key for acdl-spike-runner, deactivates+deletes old, writes new to gitignored .env.secrets (chmod 600); idempotent (re-run ends with exactly 1 active key); optional Gitea secret upload if ACDL_GITEA_TOKEN set; does NOT rotate the root key (D-034 closure = manual user step). - T-8.6 (lead): scripts/verify_phase08.sh - loads rotated key from .env.secrets, asserts caller identity is acdl-spike-runner (not root), S3 bucket + DynamoDB table + IAM user + scoped policy with DenyEverythingElse all present, .env.secrets + .bootstrap_state.json gitignored. Uses heredoc python to avoid bash quoting issues. - T-8.7 (lead): terraform/bootstrap/README.md runbook (6 steps incl. manual D-034 root-key rotation) + .gitignore (.env.secrets + .bootstrap_state.json). Spike vs v1.2 boundary table. bash -n + gitignore checks pass.	2026-07-21 19:00:08 +00:00