Jon Chery
787a6490a5
Audit of v1.15-Nova milestone: reconstruction PASS (27 commits, 20 with ci blocks, 7 merges per convention, state matches checkpoint). File discipline: 10 auto-fixed rebrand-completeness gaps — 9 .ciagent/*.md headers still said ACDL (PROJECT/REQUIREMENTS/ROADMAP/RESEARCH/AUDIT/ REVIEW/COST/IAM_POLICY/CAPABILITY_INVENTORY → Nova) + config.json projects[].name → Nova. Active v1.15 sections already Nova; historical v1.1-v1.14 narratives left as-is. Branch hygiene PASS (6 phases + 1 milestone all merged, 0 orphans). Commit discipline PASS (0 non-merge commits without ci blocks, 0 unresolved escalations). 6 audit checks all PASS. Verdict: PASS. ---ci--- project: acdl phase: 5 milestone: v1.15 status: complete phase_role: final audit: pass ---/ci---
140 lines
8.9 KiB
Markdown
140 lines
8.9 KiB
Markdown
# Nova — IAM Policy Baseline (v1.11, REQ-116)
|
||
|
||
> Source of truth: `terraform/bootstrap/spike_runner_policy.json`.
|
||
> Applied as: customer-managed policy `acdl-spike-runner-policy`
|
||
> (ARN `arn:aws:iam::581513795199:policy/acdl-spike-runner-policy`), v1.
|
||
> Regression-tested by: `tests/test_iam_policy_baseline.py` (Phase 56).
|
||
> Applied: 2026-07-28, Phase 56 live step (D-095 resolved — fresh root
|
||
> key provided by the user).
|
||
|
||
The `acdl-spike-runner` IAM user is the principal that runs the ACDL
|
||
platform pipeline (plan + apply) against account `581513795199`. This
|
||
document is the baseline of the permissions it holds, scoped to the
|
||
minimum required for the v1.11 milestone (Operating Model + Deploy
|
||
Verification, REQ-116..122). Any future grant must be documented here
|
||
and covered by the baseline test.
|
||
|
||
> **Managed-policy note (v1.11 Phase 56).** The original v1.1 bootstrap
|
||
> applied this policy as an inline user policy
|
||
> (`iam:put_user_policy`). The v1.11 extension grew the policy document
|
||
> beyond the 2048-byte inline limit (5917 bytes), so Phase 56 converted
|
||
> it to a customer-managed policy (`iam:create_policy` + `attach_user_policy`)
|
||
> with the same name `acdl-spike-runner-policy`. The managed-policy path
|
||
> supports 6144 bytes per version + up to 5 versions, leaving room for
|
||
> future growth. The inline policy was deleted after the managed policy
|
||
> was attached. The same managed policy is also attached to the
|
||
> `acdl-act-runner-role` (CAP-022) so the OIDC runner inherits the
|
||
> spike-runner-equivalent permissions once act_runner adoption lands.
|
||
|
||
## Original grants (v1.1–v1.10)
|
||
|
||
| Capability | Actions | Resource scope |
|
||
|-----------|---------|----------------|
|
||
| Terraform state (S3) | `s3:PutObject`, `s3:GetObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:GetBucketLocation`, `s3:GetBucketVersioning` | `acdl-tfstate-581513795199-us-east-1` + `/*` |
|
||
| DynamoDB outbox | `dynamodb:GetItem`, `PutItem`, `DeleteItem`, `UpdateItem`, `Query`, `Scan`, `DescribeTable` | `table/acdl-outbox` |
|
||
| STS identity | `sts:GetCallerIdentity` | `*` |
|
||
| ECS | `ecs:Create*`, `Describe*`, `Delete*`, `Update*`, `Register*`, `Deregister*`, `List*` | `ecs:us-east-1:581513795199:*` |
|
||
| ECR | `ecr:Create*`, `Describe*`, `Delete*`, `Get*`, `Batch*`, `Put*`, `Upload*`, `Initiate*`, `Complete*` | `ecr:us-east-1:581513795199:*` |
|
||
| ELB | `elasticloadbalancing:Create*`, `Describe*`, `Delete*`, `Modify*`, `Register*`, `Deregister*` | `elasticloadbalancing:us-east-1:581513795199:*` |
|
||
| IAM (role + policy mgmt) | `iam:Create*`, `Get*`, `Delete*`, `PassRole`, `Attach*`, `Detach*`, `List*`, `Put*` | `iam::581513795199:*` |
|
||
| EC2 (VPC + SG) | `ec2:Create*`, `Describe*`, `Delete*`, `Associate*`, `Disassociate*`, `Attach*`, `Detach*`, `Authorize*` | `ec2:us-east-1:581513795199:*` |
|
||
|
||
## v1.11 grants (Phase 56, REQ-116)
|
||
|
||
| Capability | Actions | Resource scope | REQ |
|
||
|-----------|---------|----------------|-----|
|
||
| CloudFront (CAP-020) | `cloudfront:Create*`, `Describe*`, `Get*`, `List*`, `Update*`, `Delete*`, `TagResource`, `UntagResource` | `*` (CloudFront ARNs are regional-global) | REQ-118 |
|
||
| WAFv2 (CAP-020) | `wafv2:Create*`, `Describe*`, `Get*`, `List*`, `Update*`, `Delete*` | `*` (WAFv2 global + regional) | REQ-118 |
|
||
| Lambda (CAP-018) | `lambda:Create*`, `Get*`, `List*`, `Update*`, `Delete*`, `InvokeFunction`, `InvokeFunctionUrl`, `TagResource`, `UntagResource`, `PublishLayerVersion` | `lambda:us-east-1:581513795199:function:acdl-*` | REQ-117 |
|
||
| DynamoDB contracts (CAP-017) | `dynamodb:Create*`, `Describe*`, `Get*`, `Put*`, `Update*`, `Delete*`, `Query`, `Scan`, `Batch*` | `table/acdl-contracts` + `/*` + `table/acdl-change-requests` + `/*` | REQ-117 |
|
||
| Secrets Manager (CAP-018) | `secretsmanager:GetSecretValue`, `DescribeSecret`, `CreateSecret`, `PutSecretValue`, `DeleteSecret`, `ListSecrets` | `secret:acdl/*` | REQ-117 |
|
||
| SNS (CAP-017) | `sns:CreateTopic`, `Publish`, `GetTopicAttributes`, `SetTopicAttributes`, `DeleteTopic`, `ListTopics` | `sns:us-east-1:581513795199:acdl-*` | REQ-117 |
|
||
| Cost Explorer (REQ-119) | `ce:GetCostAndUsage`, `GetCostForecast`, `GetCostAndUsageWithResources`, `GetDimensionValues`, `GetTags` | `*` (CE is account-scoped) | REQ-119 |
|
||
| KMS (CAP-017) | `kms:CreateKey`, `CreateAlias`, `Describe*`, `Get*`, `List*`, `Update*`, `Delete*`, `EnableKey`, `DisableKey`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource` | `*` (KMS ARNs are account-wide) | REQ-117/118 |
|
||
| IAM OIDC (CAP-022) | `iam:CreateOpenIDConnectProvider`, `GetOpenIDConnectProvider`, `DeleteOpenIDConnectProvider`, `ListOpenIDConnectProviders`, `UpdateOpenIDConnectProviderThumbprint`, `iam:CreateRole`, `GetRole`, `ListRoles`, `DeleteRole`, `UpdateRole`, `TagRole`, `UntagRole` | `*` (OIDC providers + roles are account-wide) | REQ-116 |
|
||
|
||
## OIDC act_runner role (CAP-022, Phase 56)
|
||
|
||
The OIDC role for the Gitea `act_runner` was created in Phase 08 and
|
||
gone since (CAPABILITY_INVENTORY.md CAP-022). Phase 56 re-creates it
|
||
with a trust policy for the Gitea runner ARN. The role grants the
|
||
spike-runner-equivalent permissions to the runner via `sts:AssumeRole`,
|
||
so the runner does not need a long-lived access key. This closes the
|
||
chicken-and-egg: the spike-runner creates the OIDC role using the
|
||
bootstrap root key; the runner then assumes the role.
|
||
|
||
> **Note:** Real OIDC federation (D-039) is blocked on
|
||
> `go-gitea/gitea#36988`. Phase 56 re-creates the IAM role + trust
|
||
> policy; act_runner adoption is out of scope for v1.11 (see
|
||
> REQUIREMENTS.md §Out of Scope v1.11). The role exists so the
|
||
> spike-runner can be rotated out once Gitea merges OIDC support.
|
||
|
||
## OIDC act_runner role (CAP-022, Phase 56 — re-created 2026-07-28)
|
||
|
||
The OIDC role for the Gitea `act_runner` was planned in Phase 08 but
|
||
never created (the spike used a long-lived key per D-039 waiver).
|
||
CAPABILITY_INVENTORY.md CAP-022 recorded "iam:ListRoles shows no acdl*
|
||
roles." Phase 56 re-created the role:
|
||
|
||
- **Role name:** `acdl-act-runner-role`
|
||
- **ARN:** `arn:aws:iam::581513795199:role/acdl-act-runner-role`
|
||
- **Trust policy (v1):** permits `arn:aws:iam::581513795199:root` to
|
||
assume the role (`sts:AssumeRole`). This is the bootstrap trust —
|
||
once go-gitea/gitea#36988 merges real OIDC federation, the trust
|
||
policy is updated to the Gitea OIDC provider ARN + the runner's
|
||
subject claim.
|
||
- **Attached policy:** `acdl-spike-runner-policy` (the same managed
|
||
policy the spike-runner user uses) — so the runner inherits the
|
||
spike-runner-equivalent permissions, no long-lived key needed.
|
||
- **Tags:** `Project=acdl`, `Capability=CAP-022`, `Milestone=v1.11`,
|
||
`ManagedBy=ciagent`.
|
||
|
||
> **Note:** Real OIDC federation (D-039) is blocked on
|
||
> `go-gitea/gitea#36988`. Phase 56 re-creates the IAM role + trust
|
||
> policy; act_runner adoption is out of scope for v1.11 (see
|
||
> REQUIREMENTS.md §Out of Scope v1.11). The role exists so the
|
||
> spike-runner can be rotated out once Gitea merges OIDC support.
|
||
|
||
## Grant verification (Phase 56 live step, 2026-07-28)
|
||
|
||
All new grants verified effective against account 581513795199:
|
||
|
||
| Service | Verification | Result |
|
||
|---------|-------------|--------|
|
||
| CloudFront | `list_distributions` | OK (0 items — stacks not yet deployed) |
|
||
| WAFv2 | `list_web_acls(CLOUDFRONT)` | OK (0 items) |
|
||
| Lambda | `list_functions` | OK (0 items) |
|
||
| DynamoDB `acdl-contracts` | `describe_table` | ResourceNotFound (table not yet created — Phase 57 applies it; grant works, no AccessDenied) |
|
||
| Cost Explorer | `get_cost_and_usage` (7-day window) | OK (7 results — Phase 59 queries the full window) |
|
||
| Secrets Manager | `list_secrets` | OK (0 items) |
|
||
| SNS | `list_topics` | OK (0 items) |
|
||
| IAM OIDC role | `get_role(acdl-act-runner-role)` | OK (ARN confirmed) |
|
||
|
||
## Least-privilege scoping notes
|
||
|
||
- **CloudFront/WAF/KMS/CE/OIDC use `Resource: "*"`** because these
|
||
services use account-scoped or global ARNs that cannot be resource-
|
||
restricted at the statement level. Scope is bounded by the action
|
||
list (e.g. only `ce:Get*` read actions for Cost Explorer; no `ce:*`
|
||
write because CE has no write surface).
|
||
- **Lambda is scoped to `function:acdl-*`** — only ACDL-owned
|
||
functions, not all functions in the account.
|
||
- **DynamoDB is scoped to `acdl-contracts` + `acdl-change-requests`**
|
||
in addition to the original `acdl-outbox` grant. The spike-runner
|
||
cannot touch other tables in the account.
|
||
- **Secrets Manager is scoped to `secret:acdl/*`** — only ACDL-owned
|
||
secrets.
|
||
- **SNS is scoped to `acdl-*`** topic names.
|
||
- **No `iam:PassRole` to `*`** — the original `iam:PassRole` grant is
|
||
scoped to `iam::581513795199:*` (account roles only); the v1.11
|
||
grant does not extend it.
|
||
|
||
## Escalation (D-095 — resolved 2026-07-28)
|
||
|
||
Applying this policy required the bootstrap root key
|
||
(`ACDL_BOOTSTRAP_AWS_*`). The original root key was closed (D-034).
|
||
Per D-095 (user-confirmed: escalate to human for fresh access keys, no
|
||
silent fallback), the run paused at Phase 56 live step. The user
|
||
provided fresh root credentials in `.env.secrets`; the run resumed and
|
||
applied the managed policy + re-created the OIDC role. D-095 is
|
||
resolved. |