Jon Chery
0fea29cdbb
---ci--- project: acdl phase: 12 milestone: v1.2 status: verify verdict: VERIFIED requirements: covered: [REQ-30] ---/ci--- Phase 12 plan-as-execute + verify. scripts/verify_phase12.sh green (22 assertions). All Wave 1 + Wave 2 tasks complete: - T-12.1: run_spike_*.sh -> run_platform.sh (D-048, --plan-only flag) - T-12.2: spike_runner_policy.json expanded (ECS + ECR + ELB + IAM + EC2) - T-12.3: idempotency documented in bootstrap scripts - T-12.4: P1-1 redacted (no live AWS key IDs in .ciagent/) - T-12.5: P1-B fixed (PERSONAS.md platform/registry -> modules-ir/registry.json) Subagent confirmed run_platform.sh --plan-only runs against real AWS, exit 0. Ready to ship v1.2.2.
158 lines
4.6 KiB
JSON
158 lines
4.6 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "SpikeStateBucketReadWrite",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:PutObject",
|
|
"s3:GetObject",
|
|
"s3:DeleteObject",
|
|
"s3:ListBucket",
|
|
"s3:GetBucketLocation",
|
|
"s3:GetBucketVersioning"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "SpikeOutboxTableReadWrite",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"dynamodb:GetItem",
|
|
"dynamodb:PutItem",
|
|
"dynamodb:DeleteItem",
|
|
"dynamodb:UpdateItem",
|
|
"dynamodb:Query",
|
|
"dynamodb:Scan",
|
|
"dynamodb:DescribeTable"
|
|
],
|
|
"Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
|
|
},
|
|
{
|
|
"Sid": "SpikeStsSelfIdentify",
|
|
"Effect": "Allow",
|
|
"Action": "sts:GetCallerIdentity",
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "SpikeEcsReadWrite",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecs:CreateCluster",
|
|
"ecs:DescribeCluster",
|
|
"ecs:DeleteCluster",
|
|
"ecs:CreateService",
|
|
"ecs:DescribeService",
|
|
"ecs:UpdateService",
|
|
"ecs:DeleteService",
|
|
"ecs:RegisterTaskDefinition",
|
|
"ecs:DescribeTaskDefinition",
|
|
"ecs:DeregisterTaskDefinition",
|
|
"ecs:ListTasks",
|
|
"ecs:DescribeTasks"
|
|
],
|
|
"Resource": "arn:aws:ecs:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Sid": "SpikeEcrReadWrite",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecr:CreateRepository",
|
|
"ecr:DescribeRepositories",
|
|
"ecr:DeleteRepository",
|
|
"ecr:GetAuthorizationToken",
|
|
"ecr:BatchCheckLayerAvailability",
|
|
"ecr:GetDownloadUrlForLayer",
|
|
"ecr:BatchGetImage",
|
|
"ecr:CompleteLayerUpload",
|
|
"ecr:InitiateLayerUpload",
|
|
"ecr:PutImage",
|
|
"ecr:UploadLayerPart"
|
|
],
|
|
"Resource": "arn:aws:ecr:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Sid": "SpikeElbReadWrite",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:CreateLoadBalancer",
|
|
"elasticloadbalancing:DescribeLoadBalancers",
|
|
"elasticloadbalancing:DeleteLoadBalancer",
|
|
"elasticloadbalancing:CreateListener",
|
|
"elasticloadbalancing:DescribeListeners",
|
|
"elasticloadbalancing:DeleteListener",
|
|
"elasticloadbalancing:CreateTargetGroup",
|
|
"elasticloadbalancing:DescribeTargetGroups",
|
|
"elasticloadbalancing:DeleteTargetGroup",
|
|
"elasticloadbalancing:ModifyTargetGroupAttributes",
|
|
"elasticloadbalancing:RegisterTargets",
|
|
"elasticloadbalancing:DeregisterTargets"
|
|
],
|
|
"Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Sid": "SpikeIamReadWrite",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:CreateRole",
|
|
"iam:GetRole",
|
|
"iam:DeleteRole",
|
|
"iam:PassRole",
|
|
"iam:CreatePolicy",
|
|
"iam:GetPolicy",
|
|
"iam:DeletePolicy",
|
|
"iam:AttachRolePolicy",
|
|
"iam:DetachRolePolicy",
|
|
"iam:ListRolePolicies",
|
|
"iam:ListAttachedRolePolicies",
|
|
"iam:PutRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::581513795199:*"
|
|
},
|
|
{
|
|
"Sid": "SpikeEc2VpcReadWrite",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:CreateVpc",
|
|
"ec2:DescribeVpcs",
|
|
"ec2:DeleteVpc",
|
|
"ec2:CreateSubnet",
|
|
"ec2:DescribeSubnets",
|
|
"ec2:DeleteSubnet",
|
|
"ec2:CreateRouteTable",
|
|
"ec2:DescribeRouteTables",
|
|
"ec2:DeleteRouteTable",
|
|
"ec2:AssociateRouteTable",
|
|
"ec2:DisassociateRouteTable",
|
|
"ec2:CreateInternetGateway",
|
|
"ec2:DescribeInternetGateways",
|
|
"ec2:DeleteInternetGateway",
|
|
"ec2:AttachInternetGateway",
|
|
"ec2:DetachInternetGateway",
|
|
"ec2:CreateSecurityGroup",
|
|
"ec2:DescribeSecurityGroups",
|
|
"ec2:DeleteSecurityGroup",
|
|
"ec2:AuthorizeSecurityGroupIngress"
|
|
],
|
|
"Resource": "arn:aws:ec2:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Sid": "DenyEverythingElse",
|
|
"Effect": "Deny",
|
|
"Action": "*",
|
|
"NotResource": [
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*",
|
|
"arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox",
|
|
"arn:aws:ecs:us-east-1:581513795199:*",
|
|
"arn:aws:ecr:us-east-1:581513795199:*",
|
|
"arn:aws:elasticloadbalancing:us-east-1:581513795199:*",
|
|
"arn:aws:iam::581513795199:*",
|
|
"arn:aws:ec2:us-east-1:581513795199:*"
|
|
]
|
|
}
|
|
]
|
|
} |