Jon Chery
7eec07fc15
Vertical slice 1 of Phase 56 (REQ-116). Offline-testable deliverables
landed; the live IAM apply step is escalated (D-095) below.
terraform/bootstrap/spike_runner_policy.json — extended with the minimum
permissions to terraform apply + probe CAP-017..022:
- cloudfront:* (CAP-020 static-assets stack)
- wafv2:* (CAP-020 WAF ACL)
- lambda:* on function:acdl-* (CAP-018 contract-ingestor)
- dynamodb:* on acdl-contracts + acdl-change-requests (CAP-017)
- secretsmanager:GetSecretValue on secret:acdl/* (CAP-018 github-token)
- sns:* on acdl-* (CAP-017 acdl-sod-halt)
- ce:Get* (REQ-119 Cost Explorer read-only)
- kms:* (CAP-017 platform + per-stack CMKs)
- iam:CreateOpenIDConnectProvider + iam:CreateRole (CAP-022 OIDC re-create)
.ciagent/IAM_POLICY.md — new baseline document. Original grants
(v1.1–v1.10) + v1.11 grants table + least-privilege scoping notes +
OIDC act_runner role plan + D-095 escalation note.
tests/test_iam_policy_baseline.py — 15 tests. Asserts the required
actions are present per service group, Lambda scoped to acdl-*, CE
read-only, no iam:PassRole to Resource:*, DynamoDB acdl-contracts in
resource. Regression-testable: any future permission drift surfaces as
a test failure at milestone COMPLETE (D-091 gate).
Test results: 15/15 pass. Full offline suite 509/509 pass (pre-existing
test_seeded_registry_runs_and_reports_honest_status in
test_verify_regression_mode.py hangs without AWS creds — environmental,
not introduced here).
---ci---
project: acdl
phase: 56
milestone: v1.11
status: execute
escalation:
type: deploy
id: D-095
reason: ACDL_BOOTSTRAP_AWS_* not set in the execution environment
blocking: live IAM policy apply (aws iam put-user-policy) + OIDC role
re-creation (CAP-022) — requires an admin AWS principal
action_required: provide fresh ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID +
ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY to the run environment, then
re-invoke ciagent-run to resume Phase 56 live step
fallback: none (D-095 confirmed: escalate to human, no silent fallback
to the deck-marking path)
---/ci---
240 lines
5.8 KiB
JSON
240 lines
5.8 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:PutObject",
|
|
"s3:GetObject",
|
|
"s3:DeleteObject",
|
|
"s3:ListBucket",
|
|
"s3:GetBucketLocation",
|
|
"s3:GetBucketVersioning"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"dynamodb:GetItem",
|
|
"dynamodb:PutItem",
|
|
"dynamodb:DeleteItem",
|
|
"dynamodb:UpdateItem",
|
|
"dynamodb:Query",
|
|
"dynamodb:Scan",
|
|
"dynamodb:DescribeTable"
|
|
],
|
|
"Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "sts:GetCallerIdentity",
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecs:Create*",
|
|
"ecs:Describe*",
|
|
"ecs:Delete*",
|
|
"ecs:Update*",
|
|
"ecs:Register*",
|
|
"ecs:Deregister*",
|
|
"ecs:List*"
|
|
],
|
|
"Resource": "arn:aws:ecs:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecr:Create*",
|
|
"ecr:Describe*",
|
|
"ecr:Delete*",
|
|
"ecr:Get*",
|
|
"ecr:Batch*",
|
|
"ecr:Put*",
|
|
"ecr:Upload*",
|
|
"ecr:Initiate*",
|
|
"ecr:Complete*"
|
|
],
|
|
"Resource": "arn:aws:ecr:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:Create*",
|
|
"elasticloadbalancing:Describe*",
|
|
"elasticloadbalancing:Delete*",
|
|
"elasticloadbalancing:Modify*",
|
|
"elasticloadbalancing:Register*",
|
|
"elasticloadbalancing:Deregister*"
|
|
],
|
|
"Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:Create*",
|
|
"iam:Get*",
|
|
"iam:Delete*",
|
|
"iam:PassRole",
|
|
"iam:Attach*",
|
|
"iam:Detach*",
|
|
"iam:List*",
|
|
"iam:Put*"
|
|
],
|
|
"Resource": "arn:aws:iam::581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:Create*",
|
|
"ec2:Describe*",
|
|
"ec2:Delete*",
|
|
"ec2:Associate*",
|
|
"ec2:Disassociate*",
|
|
"ec2:Attach*",
|
|
"ec2:Detach*",
|
|
"ec2:Authorize*"
|
|
],
|
|
"Resource": "arn:aws:ec2:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"cloudfront:Create*",
|
|
"cloudfront:Describe*",
|
|
"cloudfront:Get*",
|
|
"cloudfront:List*",
|
|
"cloudfront:Update*",
|
|
"cloudfront:Delete*",
|
|
"cloudfront:TagResource",
|
|
"cloudfront:UntagResource"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"wafv2:Create*",
|
|
"wafv2:Describe*",
|
|
"wafv2:Get*",
|
|
"wafv2:List*",
|
|
"wafv2:Update*",
|
|
"wafv2:Delete*"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"lambda:Create*",
|
|
"lambda:Get*",
|
|
"lambda:List*",
|
|
"lambda:Update*",
|
|
"lambda:Delete*",
|
|
"lambda:InvokeFunction",
|
|
"lambda:InvokeFunctionUrl",
|
|
"lambda:TagResource",
|
|
"lambda:UntagResource",
|
|
"lambda:PublishLayerVersion"
|
|
],
|
|
"Resource": "arn:aws:lambda:us-east-1:581513795199:function:acdl-*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"dynamodb:Create*",
|
|
"dynamodb:Describe*",
|
|
"dynamodb:Get*",
|
|
"dynamodb:Put*",
|
|
"dynamodb:Update*",
|
|
"dynamodb:Delete*",
|
|
"dynamodb:Query",
|
|
"dynamodb:Scan",
|
|
"dynamodb:Batch*"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:dynamodb:us-east-1:581513795199:table/acdl-contracts",
|
|
"arn:aws:dynamodb:us-east-1:581513795199:table/acdl-contracts/*",
|
|
"arn:aws:dynamodb:us-east-1:581513795199:table/acdl-change-requests",
|
|
"arn:aws:dynamodb:us-east-1:581513795199:table/acdl-change-requests/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"secretsmanager:GetSecretValue",
|
|
"secretsmanager:DescribeSecret",
|
|
"secretsmanager:CreateSecret",
|
|
"secretsmanager:PutSecretValue",
|
|
"secretsmanager:DeleteSecret",
|
|
"secretsmanager:ListSecrets"
|
|
],
|
|
"Resource": "arn:aws:secretsmanager:us-east-1:581513795199:secret:acdl/*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"sns:CreateTopic",
|
|
"sns:Publish",
|
|
"sns:GetTopicAttributes",
|
|
"sns:SetTopicAttributes",
|
|
"sns:DeleteTopic",
|
|
"sns:ListTopics"
|
|
],
|
|
"Resource": "arn:aws:sns:us-east-1:581513795199:acdl-*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ce:GetCostAndUsage",
|
|
"ce:GetCostForecast",
|
|
"ce:GetCostAndUsageWithResources",
|
|
"ce:GetDimensionValues",
|
|
"ce:GetTags"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"kms:CreateKey",
|
|
"kms:CreateAlias",
|
|
"kms:Describe*",
|
|
"kms:Get*",
|
|
"kms:List*",
|
|
"kms:Update*",
|
|
"kms:Delete*",
|
|
"kms:EnableKey",
|
|
"kms:DisableKey",
|
|
"kms:ScheduleKeyDeletion",
|
|
"kms:TagResource",
|
|
"kms:UntagResource"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:CreateOpenIDConnectProvider",
|
|
"iam:GetOpenIDConnectProvider",
|
|
"iam:DeleteOpenIDConnectProvider",
|
|
"iam:ListOpenIDConnectProviders",
|
|
"iam:UpdateOpenIDConnectProviderThumbprint",
|
|
"iam:CreateRole",
|
|
"iam:GetRole",
|
|
"iam:ListRoles",
|
|
"iam:DeleteRole",
|
|
"iam:UpdateRole",
|
|
"iam:TagRole",
|
|
"iam:UntagRole"
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|