# Nova — IAM Policy Baseline (v1.11, REQ-116)

> Source of truth: `terraform/bootstrap/spike_runner_policy.json`.
> Applied as: customer-managed policy `acdl-spike-runner-policy`
> (ARN `arn:aws:iam::581513795199:policy/acdl-spike-runner-policy`), v1.
> Regression-tested by: `tests/test_iam_policy_baseline.py` (Phase 56).
> Applied: 2026-07-28, Phase 56 live step (D-095 resolved — fresh root
> key provided by the user).

The `acdl-spike-runner` IAM user is the principal that runs the ACDL
platform pipeline (plan + apply) against account `581513795199`. This
document is the baseline of the permissions it holds, scoped to the
minimum required for the v1.11 milestone (Operating Model + Deploy
Verification, REQ-116..122). Any future grant must be documented here
and covered by the baseline test.

> **Managed-policy note (v1.11 Phase 56).** The original v1.1 bootstrap
> applied this policy as an inline user policy
> (`iam:put_user_policy`). The v1.11 extension grew the policy document
> beyond the 2048-byte inline limit (5917 bytes), so Phase 56 converted
> it to a customer-managed policy (`iam:create_policy` + `attach_user_policy`)
> with the same name `acdl-spike-runner-policy`. The managed-policy path
> supports 6144 bytes per version + up to 5 versions, leaving room for
> future growth. The inline policy was deleted after the managed policy
> was attached. The same managed policy is also attached to the
> `acdl-act-runner-role` (CAP-022) so the OIDC runner inherits the
> spike-runner-equivalent permissions once act_runner adoption lands.

## Original grants (v1.1–v1.10)

| Capability | Actions | Resource scope |
|-----------|---------|----------------|
| Terraform state (S3) | `s3:PutObject`, `s3:GetObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:GetBucketLocation`, `s3:GetBucketVersioning` | `acdl-tfstate-581513795199-us-east-1` + `/*` |
| DynamoDB outbox | `dynamodb:GetItem`, `PutItem`, `DeleteItem`, `UpdateItem`, `Query`, `Scan`, `DescribeTable` | `table/acdl-outbox` |
| STS identity | `sts:GetCallerIdentity` | `*` |
| ECS | `ecs:Create*`, `Describe*`, `Delete*`, `Update*`, `Register*`, `Deregister*`, `List*` | `ecs:us-east-1:581513795199:*` |
| ECR | `ecr:Create*`, `Describe*`, `Delete*`, `Get*`, `Batch*`, `Put*`, `Upload*`, `Initiate*`, `Complete*` | `ecr:us-east-1:581513795199:*` |
| ELB | `elasticloadbalancing:Create*`, `Describe*`, `Delete*`, `Modify*`, `Register*`, `Deregister*` | `elasticloadbalancing:us-east-1:581513795199:*` |
| IAM (role + policy mgmt) | `iam:Create*`, `Get*`, `Delete*`, `PassRole`, `Attach*`, `Detach*`, `List*`, `Put*` | `iam::581513795199:*` |
| EC2 (VPC + SG) | `ec2:Create*`, `Describe*`, `Delete*`, `Associate*`, `Disassociate*`, `Attach*`, `Detach*`, `Authorize*` | `ec2:us-east-1:581513795199:*` |

## v1.11 grants (Phase 56, REQ-116)

| Capability | Actions | Resource scope | REQ |
|-----------|---------|----------------|-----|
| CloudFront (CAP-020) | `cloudfront:Create*`, `Describe*`, `Get*`, `List*`, `Update*`, `Delete*`, `TagResource`, `UntagResource` | `*` (CloudFront ARNs are regional-global) | REQ-118 |
| WAFv2 (CAP-020) | `wafv2:Create*`, `Describe*`, `Get*`, `List*`, `Update*`, `Delete*` | `*` (WAFv2 global + regional) | REQ-118 |
| Lambda (CAP-018) | `lambda:Create*`, `Get*`, `List*`, `Update*`, `Delete*`, `InvokeFunction`, `InvokeFunctionUrl`, `TagResource`, `UntagResource`, `PublishLayerVersion` | `lambda:us-east-1:581513795199:function:acdl-*` | REQ-117 |
| DynamoDB contracts (CAP-017) | `dynamodb:Create*`, `Describe*`, `Get*`, `Put*`, `Update*`, `Delete*`, `Query`, `Scan`, `Batch*` | `table/acdl-contracts` + `/*` + `table/acdl-change-requests` + `/*` | REQ-117 |
| Secrets Manager (CAP-018) | `secretsmanager:GetSecretValue`, `DescribeSecret`, `CreateSecret`, `PutSecretValue`, `DeleteSecret`, `ListSecrets` | `secret:acdl/*` | REQ-117 |
| SNS (CAP-017) | `sns:CreateTopic`, `Publish`, `GetTopicAttributes`, `SetTopicAttributes`, `DeleteTopic`, `ListTopics` | `sns:us-east-1:581513795199:acdl-*` | REQ-117 |
| Cost Explorer (REQ-119) | `ce:GetCostAndUsage`, `GetCostForecast`, `GetCostAndUsageWithResources`, `GetDimensionValues`, `GetTags` | `*` (CE is account-scoped) | REQ-119 |
| KMS (CAP-017) | `kms:CreateKey`, `CreateAlias`, `Describe*`, `Get*`, `List*`, `Update*`, `Delete*`, `EnableKey`, `DisableKey`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource` | `*` (KMS ARNs are account-wide) | REQ-117/118 |
| IAM OIDC (CAP-022) | `iam:CreateOpenIDConnectProvider`, `GetOpenIDConnectProvider`, `DeleteOpenIDConnectProvider`, `ListOpenIDConnectProviders`, `UpdateOpenIDConnectProviderThumbprint`, `iam:CreateRole`, `GetRole`, `ListRoles`, `DeleteRole`, `UpdateRole`, `TagRole`, `UntagRole` | `*` (OIDC providers + roles are account-wide) | REQ-116 |

## OIDC act_runner role (CAP-022, Phase 56)

The OIDC role for the Gitea `act_runner` was created in Phase 08 and
gone since (CAPABILITY_INVENTORY.md CAP-022). Phase 56 re-creates it
with a trust policy for the Gitea runner ARN. The role grants the
spike-runner-equivalent permissions to the runner via `sts:AssumeRole`,
so the runner does not need a long-lived access key. This closes the
chicken-and-egg: the spike-runner creates the OIDC role using the
bootstrap root key; the runner then assumes the role.

> **Note:** Real OIDC federation (D-039) is blocked on
> `go-gitea/gitea#36988`. Phase 56 re-creates the IAM role + trust
> policy; act_runner adoption is out of scope for v1.11 (see
> REQUIREMENTS.md §Out of Scope v1.11). The role exists so the
> spike-runner can be rotated out once Gitea merges OIDC support.

## OIDC act_runner role (CAP-022, Phase 56 — re-created 2026-07-28)

The OIDC role for the Gitea `act_runner` was planned in Phase 08 but
never created (the spike used a long-lived key per D-039 waiver).
CAPABILITY_INVENTORY.md CAP-022 recorded "iam:ListRoles shows no acdl*
roles." Phase 56 re-created the role:

- **Role name:** `acdl-act-runner-role`
- **ARN:** `arn:aws:iam::581513795199:role/acdl-act-runner-role`
- **Trust policy (v1):** permits `arn:aws:iam::581513795199:root` to
  assume the role (`sts:AssumeRole`). This is the bootstrap trust —
  once go-gitea/gitea#36988 merges real OIDC federation, the trust
  policy is updated to the Gitea OIDC provider ARN + the runner's
  subject claim.
- **Attached policy:** `acdl-spike-runner-policy` (the same managed
  policy the spike-runner user uses) — so the runner inherits the
  spike-runner-equivalent permissions, no long-lived key needed.
- **Tags:** `Project=acdl`, `Capability=CAP-022`, `Milestone=v1.11`,
  `ManagedBy=ciagent`.

> **Note:** Real OIDC federation (D-039) is blocked on
> `go-gitea/gitea#36988`. Phase 56 re-creates the IAM role + trust
> policy; act_runner adoption is out of scope for v1.11 (see
> REQUIREMENTS.md §Out of Scope v1.11). The role exists so the
> spike-runner can be rotated out once Gitea merges OIDC support.

## Grant verification (Phase 56 live step, 2026-07-28)

All new grants verified effective against account 581513795199:

| Service | Verification | Result |
|---------|-------------|--------|
| CloudFront | `list_distributions` | OK (0 items — stacks not yet deployed) |
| WAFv2 | `list_web_acls(CLOUDFRONT)` | OK (0 items) |
| Lambda | `list_functions` | OK (0 items) |
| DynamoDB `acdl-contracts` | `describe_table` | ResourceNotFound (table not yet created — Phase 57 applies it; grant works, no AccessDenied) |
| Cost Explorer | `get_cost_and_usage` (7-day window) | OK (7 results — Phase 59 queries the full window) |
| Secrets Manager | `list_secrets` | OK (0 items) |
| SNS | `list_topics` | OK (0 items) |
| IAM OIDC role | `get_role(acdl-act-runner-role)` | OK (ARN confirmed) |

## Least-privilege scoping notes

- **CloudFront/WAF/KMS/CE/OIDC use `Resource: "*"`** because these
  services use account-scoped or global ARNs that cannot be resource-
  restricted at the statement level. Scope is bounded by the action
  list (e.g. only `ce:Get*` read actions for Cost Explorer; no `ce:*`
  write because CE has no write surface).
- **Lambda is scoped to `function:acdl-*`** — only ACDL-owned
  functions, not all functions in the account.
- **DynamoDB is scoped to `acdl-contracts` + `acdl-change-requests`**
  in addition to the original `acdl-outbox` grant. The spike-runner
  cannot touch other tables in the account.
- **Secrets Manager is scoped to `secret:acdl/*`** — only ACDL-owned
  secrets.
- **SNS is scoped to `acdl-*`** topic names.
- **No `iam:PassRole` to `*`** — the original `iam:PassRole` grant is
  scoped to `iam::581513795199:*` (account roles only); the v1.11
  grant does not extend it.

## Escalation (D-095 — resolved 2026-07-28)

Applying this policy required the bootstrap root key
(`ACDL_BOOTSTRAP_AWS_*`). The original root key was closed (D-034).
Per D-095 (user-confirmed: escalate to human for fresh access keys, no
silent fallback), the run paused at Phase 56 live step. The user
provided fresh root credentials in `.env.secrets`; the run resumed and
applied the managed policy + re-created the OIDC role. D-095 is
resolved.