continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity
Files
3e11b0fafd35d276cfb89a722391e2147e4bdd05
acdl/.ciagent/IAM_POLICY.md
T
Jon Chery e5d8dadbd4 feat(P56): IAM re-bootstrap live step — managed policy + OIDC role 
D-095 RESOLVED. User provided fresh root credentials in .env.secrets;
the run resumed and applied the IAM baseline against account
581513795199.

Live actions (2026-07-28):
1. Converted spike_runner_policy.json from an inline user policy to a
   customer-managed policy acdl-spike-runner-policy (ARN
   arn:aws:iam::581513795199:policy/acdl-spike-runner-policy). The
   extended policy (5917 bytes) exceeded the 2048-byte inline limit;
   the managed-policy path supports 6144 bytes per version + 5
   versions. Inline policy deleted; managed policy attached.
2. Re-created the acdl-act-runner-role OIDC role (CAP-022 — was gone
   since Phase 08). Trust policy permits root assume until
   go-gitea/gitea#36988 merges real OIDC federation. Same managed
   policy attached so the runner inherits spike-runner-equivalent
   permissions, no long-lived key needed.

Grant verification (all OK):
- cloudfront:ListDistributions — OK (0 items, stacks not yet deployed)
- wafv2:ListWebAcls(CLOUDFRONT) — OK
- lambda:ListFunctions — OK
- dynamodb:DescribeTable(acdl-contracts) — ResourceNotFound (table not
  yet created — Phase 57 applies it; grant works, no AccessDenied)
- ce:GetCostAndUsage (7-day window) — OK (7 results — Phase 59 queries
  the full window)
- secretsmanager:ListSecrets — OK
- sns:ListTopics — OK
- iam:GetRole(acdl-act-runner-role) — OK

terraform/bootstrap/apply_iam_baseline.py — new idempotent script that
records the live step (create/version managed policy, attach to user +
role, delete leftover inline, ensure runner role). Re-ran to confirm
idempotency (created v2, deleted v1).

.ciagent/IAM_POLICY.md — updated with the managed-policy note, the
OIDC role ARN + trust policy, the grant verification table, and the
D-095 resolution note.

terraform/bootstrap/README.md — added the v1.11 Phase 56 section
documenting apply_iam_baseline.py.

Baseline test: 15/15 pass.

---ci---
project: acdl
phase: 56
milestone: v1.11
status: execute
escalation:
  type: deploy
  id: D-095
  status: resolved
  resolved_at: 2026-07-28
  resolution: user provided fresh root credentials in .env.secrets;
    managed policy applied + OIDC role re-created
---/ci---
2026-07-28 13:01:28 +00:00

8.9 KiB
Raw Blame History

ACDL — IAM Policy Baseline (v1.11, REQ-116)

Source of truth: terraform/bootstrap/spike_runner_policy.json. Applied as: customer-managed policy acdl-spike-runner-policy (ARN arn:aws:iam::581513795199:policy/acdl-spike-runner-policy), v1. Regression-tested by: tests/test_iam_policy_baseline.py (Phase 56). Applied: 2026-07-28, Phase 56 live step (D-095 resolved — fresh root key provided by the user).

The acdl-spike-runner IAM user is the principal that runs the ACDL platform pipeline (plan + apply) against account 581513795199. This document is the baseline of the permissions it holds, scoped to the minimum required for the v1.11 milestone (Operating Model + Deploy Verification, REQ-116..122). Any future grant must be documented here and covered by the baseline test.

Managed-policy note (v1.11 Phase 56). The original v1.1 bootstrap applied this policy as an inline user policy (iam:put_user_policy). The v1.11 extension grew the policy document beyond the 2048-byte inline limit (5917 bytes), so Phase 56 converted it to a customer-managed policy (iam:create_policy + attach_user_policy) with the same name acdl-spike-runner-policy. The managed-policy path supports 6144 bytes per version + up to 5 versions, leaving room for future growth. The inline policy was deleted after the managed policy was attached. The same managed policy is also attached to the acdl-act-runner-role (CAP-022) so the OIDC runner inherits the spike-runner-equivalent permissions once act_runner adoption lands.

Original grants (v1.1–v1.10)

Capability Actions Resource scope
Terraform state (S3) s3:PutObject, s3:GetObject, s3:DeleteObject, s3:ListBucket, s3:GetBucketLocation, s3:GetBucketVersioning acdl-tfstate-581513795199-us-east-1 + /*
DynamoDB outbox dynamodb:GetItem, PutItem, DeleteItem, UpdateItem, Query, Scan, DescribeTable table/acdl-outbox
STS identity sts:GetCallerIdentity *
ECS ecs:Create*, Describe*, Delete*, Update*, Register*, Deregister*, List* ecs:us-east-1:581513795199:*
ECR ecr:Create*, Describe*, Delete*, Get*, Batch*, Put*, Upload*, Initiate*, Complete* ecr:us-east-1:581513795199:*
ELB elasticloadbalancing:Create*, Describe*, Delete*, Modify*, Register*, Deregister* elasticloadbalancing:us-east-1:581513795199:*
IAM (role + policy mgmt) iam:Create*, Get*, Delete*, PassRole, Attach*, Detach*, List*, Put* iam::581513795199:*
EC2 (VPC + SG) ec2:Create*, Describe*, Delete*, Associate*, Disassociate*, Attach*, Detach*, Authorize* ec2:us-east-1:581513795199:*

v1.11 grants (Phase 56, REQ-116)

Capability Actions Resource scope REQ
CloudFront (CAP-020) cloudfront:Create*, Describe*, Get*, List*, Update*, Delete*, TagResource, UntagResource * (CloudFront ARNs are regional-global) REQ-118
WAFv2 (CAP-020) wafv2:Create*, Describe*, Get*, List*, Update*, Delete* * (WAFv2 global + regional) REQ-118
Lambda (CAP-018) lambda:Create*, Get*, List*, Update*, Delete*, InvokeFunction, InvokeFunctionUrl, TagResource, UntagResource, PublishLayerVersion lambda:us-east-1:581513795199:function:acdl-* REQ-117
DynamoDB contracts (CAP-017) dynamodb:Create*, Describe*, Get*, Put*, Update*, Delete*, Query, Scan, Batch* table/acdl-contracts + /* + table/acdl-change-requests + /* REQ-117
Secrets Manager (CAP-018) secretsmanager:GetSecretValue, DescribeSecret, CreateSecret, PutSecretValue, DeleteSecret, ListSecrets secret:acdl/* REQ-117
SNS (CAP-017) sns:CreateTopic, Publish, GetTopicAttributes, SetTopicAttributes, DeleteTopic, ListTopics sns:us-east-1:581513795199:acdl-* REQ-117
Cost Explorer (REQ-119) ce:GetCostAndUsage, GetCostForecast, GetCostAndUsageWithResources, GetDimensionValues, GetTags * (CE is account-scoped) REQ-119
KMS (CAP-017) kms:CreateKey, CreateAlias, Describe*, Get*, List*, Update*, Delete*, EnableKey, DisableKey, ScheduleKeyDeletion, TagResource, UntagResource * (KMS ARNs are account-wide) REQ-117/118
IAM OIDC (CAP-022) iam:CreateOpenIDConnectProvider, GetOpenIDConnectProvider, DeleteOpenIDConnectProvider, ListOpenIDConnectProviders, UpdateOpenIDConnectProviderThumbprint, iam:CreateRole, GetRole, ListRoles, DeleteRole, UpdateRole, TagRole, UntagRole * (OIDC providers + roles are account-wide) REQ-116

OIDC act_runner role (CAP-022, Phase 56)

The OIDC role for the Gitea act_runner was created in Phase 08 and gone since (CAPABILITY_INVENTORY.md CAP-022). Phase 56 re-creates it with a trust policy for the Gitea runner ARN. The role grants the spike-runner-equivalent permissions to the runner via sts:AssumeRole, so the runner does not need a long-lived access key. This closes the chicken-and-egg: the spike-runner creates the OIDC role using the bootstrap root key; the runner then assumes the role.

Note: Real OIDC federation (D-039) is blocked on go-gitea/gitea#36988. Phase 56 re-creates the IAM role + trust policy; act_runner adoption is out of scope for v1.11 (see REQUIREMENTS.md §Out of Scope v1.11). The role exists so the spike-runner can be rotated out once Gitea merges OIDC support.

OIDC act_runner role (CAP-022, Phase 56 — re-created 2026-07-28)

The OIDC role for the Gitea act_runner was planned in Phase 08 but never created (the spike used a long-lived key per D-039 waiver). CAPABILITY_INVENTORY.md CAP-022 recorded "iam:ListRoles shows no acdl* roles." Phase 56 re-created the role:

  • Role name: acdl-act-runner-role
  • ARN: arn:aws:iam::581513795199:role/acdl-act-runner-role
  • Trust policy (v1): permits arn:aws:iam::581513795199:root to assume the role (sts:AssumeRole). This is the bootstrap trust — once go-gitea/gitea#36988 merges real OIDC federation, the trust policy is updated to the Gitea OIDC provider ARN + the runner's subject claim.
  • Attached policy: acdl-spike-runner-policy (the same managed policy the spike-runner user uses) — so the runner inherits the spike-runner-equivalent permissions, no long-lived key needed.
  • Tags: Project=acdl, Capability=CAP-022, Milestone=v1.11, ManagedBy=ciagent.

Note: Real OIDC federation (D-039) is blocked on go-gitea/gitea#36988. Phase 56 re-creates the IAM role + trust policy; act_runner adoption is out of scope for v1.11 (see REQUIREMENTS.md §Out of Scope v1.11). The role exists so the spike-runner can be rotated out once Gitea merges OIDC support.

Grant verification (Phase 56 live step, 2026-07-28)

All new grants verified effective against account 581513795199:

Service Verification Result
CloudFront list_distributions OK (0 items — stacks not yet deployed)
WAFv2 list_web_acls(CLOUDFRONT) OK (0 items)
Lambda list_functions OK (0 items)
DynamoDB acdl-contracts describe_table ResourceNotFound (table not yet created — Phase 57 applies it; grant works, no AccessDenied)
Cost Explorer get_cost_and_usage (7-day window) OK (7 results — Phase 59 queries the full window)
Secrets Manager list_secrets OK (0 items)
SNS list_topics OK (0 items)
IAM OIDC role get_role(acdl-act-runner-role) OK (ARN confirmed)

Least-privilege scoping notes

  • CloudFront/WAF/KMS/CE/OIDC use Resource: "*" because these services use account-scoped or global ARNs that cannot be resource- restricted at the statement level. Scope is bounded by the action list (e.g. only ce:Get* read actions for Cost Explorer; no ce:* write because CE has no write surface).
  • Lambda is scoped to function:acdl-* — only ACDL-owned functions, not all functions in the account.
  • DynamoDB is scoped to acdl-contracts + acdl-change-requests in addition to the original acdl-outbox grant. The spike-runner cannot touch other tables in the account.
  • Secrets Manager is scoped to secret:acdl/* — only ACDL-owned secrets.
  • SNS is scoped to acdl-* topic names.
  • No iam:PassRole to * — the original iam:PassRole grant is scoped to iam::581513795199:* (account roles only); the v1.11 grant does not extend it.

Escalation (D-095 — resolved 2026-07-28)

Applying this policy required the bootstrap root key (ACDL_BOOTSTRAP_AWS_*). The original root key was closed (D-034). Per D-095 (user-confirmed: escalate to human for fresh access keys, no silent fallback), the run paused at Phase 56 live step. The user provided fresh root credentials in .env.secrets; the run resumed and applied the managed policy + re-created the OIDC role. D-095 is resolved.

Reference in New Issue View Git Blame Copy Permalink