acdl/.ciagent/IAM_POLICY.md

Nova — IAM Policy Baseline (v1.11, REQ-116)

Source of truth: terraform/bootstrap/spike_runner_policy.json. Applied as: customer-managed policy acdl-spike-runner-policy (ARN arn:aws:iam::581513795199:policy/acdl-spike-runner-policy), v1. Regression-tested by: tests/test_iam_policy_baseline.py (Phase 56). Applied: 2026-07-28, Phase 56 live step (D-095 resolved — fresh root key provided by the user).

The acdl-spike-runner IAM user is the principal that runs the ACDL platform pipeline (plan + apply) against account 581513795199. This document is the baseline of the permissions it holds, scoped to the minimum required for the v1.11 milestone (Operating Model + Deploy Verification, REQ-116..122). Any future grant must be documented here and covered by the baseline test.

Managed-policy note (v1.11 Phase 56). The original v1.1 bootstrap applied this policy as an inline user policy (iam:put_user_policy). The v1.11 extension grew the policy document beyond the 2048-byte inline limit (5917 bytes), so Phase 56 converted it to a customer-managed policy (iam:create_policy + attach_user_policy) with the same name acdl-spike-runner-policy. The managed-policy path supports 6144 bytes per version + up to 5 versions, leaving room for future growth. The inline policy was deleted after the managed policy was attached. The same managed policy is also attached to the acdl-act-runner-role (CAP-022) so the OIDC runner inherits the spike-runner-equivalent permissions once act_runner adoption lands.

Original grants (v1.1–v1.10)

Capability	Actions	Resource scope
Terraform state (S3)	s3:PutObject, s3:GetObject, s3:DeleteObject, s3:ListBucket, s3:GetBucketLocation, s3:GetBucketVersioning	acdl-tfstate-581513795199-us-east-1 + /*
DynamoDB outbox	dynamodb:GetItem, PutItem, DeleteItem, UpdateItem, Query, Scan, DescribeTable	table/acdl-outbox
STS identity	sts:GetCallerIdentity	*
ECS	ecs:Create*, Describe*, Delete*, Update*, Register*, Deregister*, List*	ecs:us-east-1:581513795199:*
ECR	ecr:Create*, Describe*, Delete*, Get*, Batch*, Put*, Upload*, Initiate*, Complete*	ecr:us-east-1:581513795199:*
ELB	elasticloadbalancing:Create*, Describe*, Delete*, Modify*, Register*, Deregister*	elasticloadbalancing:us-east-1:581513795199:*
IAM (role + policy mgmt)	iam:Create*, Get*, Delete*, PassRole, Attach*, Detach*, List*, Put*	iam::581513795199:*
EC2 (VPC + SG)	ec2:Create*, Describe*, Delete*, Associate*, Disassociate*, Attach*, Detach*, Authorize*	ec2:us-east-1:581513795199:*

v1.11 grants (Phase 56, REQ-116)

Capability	Actions	Resource scope	REQ
CloudFront (CAP-020)	cloudfront:Create*, Describe*, Get*, List*, Update*, Delete*, TagResource, UntagResource	* (CloudFront ARNs are regional-global)	REQ-118
WAFv2 (CAP-020)	wafv2:Create*, Describe*, Get*, List*, Update*, Delete*	* (WAFv2 global + regional)	REQ-118
Lambda (CAP-018)	lambda:Create*, Get*, List*, Update*, Delete*, InvokeFunction, InvokeFunctionUrl, TagResource, UntagResource, PublishLayerVersion	lambda:us-east-1:581513795199:function:acdl-*	REQ-117
DynamoDB contracts (CAP-017)	dynamodb:Create*, Describe*, Get*, Put*, Update*, Delete*, Query, Scan, Batch*	table/acdl-contracts + /* + table/acdl-change-requests + /*	REQ-117
Secrets Manager (CAP-018)	secretsmanager:GetSecretValue, DescribeSecret, CreateSecret, PutSecretValue, DeleteSecret, ListSecrets	secret:acdl/*	REQ-117
SNS (CAP-017)	sns:CreateTopic, Publish, GetTopicAttributes, SetTopicAttributes, DeleteTopic, ListTopics	sns:us-east-1:581513795199:acdl-*	REQ-117
Cost Explorer (REQ-119)	ce:GetCostAndUsage, GetCostForecast, GetCostAndUsageWithResources, GetDimensionValues, GetTags	* (CE is account-scoped)	REQ-119
KMS (CAP-017)	kms:CreateKey, CreateAlias, Describe*, Get*, List*, Update*, Delete*, EnableKey, DisableKey, ScheduleKeyDeletion, TagResource, UntagResource	* (KMS ARNs are account-wide)	REQ-117/118
IAM OIDC (CAP-022)	iam:CreateOpenIDConnectProvider, GetOpenIDConnectProvider, DeleteOpenIDConnectProvider, ListOpenIDConnectProviders, UpdateOpenIDConnectProviderThumbprint, iam:CreateRole, GetRole, ListRoles, DeleteRole, UpdateRole, TagRole, UntagRole	* (OIDC providers + roles are account-wide)	REQ-116

OIDC act_runner role (CAP-022, Phase 56)

The OIDC role for the Gitea act_runner was created in Phase 08 and gone since (CAPABILITY_INVENTORY.md CAP-022). Phase 56 re-creates it with a trust policy for the Gitea runner ARN. The role grants the spike-runner-equivalent permissions to the runner via sts:AssumeRole, so the runner does not need a long-lived access key. This closes the chicken-and-egg: the spike-runner creates the OIDC role using the bootstrap root key; the runner then assumes the role.

Note: Real OIDC federation (D-039) is blocked on go-gitea/gitea#36988. Phase 56 re-creates the IAM role + trust policy; act_runner adoption is out of scope for v1.11 (see REQUIREMENTS.md §Out of Scope v1.11). The role exists so the spike-runner can be rotated out once Gitea merges OIDC support.

OIDC act_runner role (CAP-022, Phase 56 — re-created 2026-07-28)

The OIDC role for the Gitea act_runner was planned in Phase 08 but never created (the spike used a long-lived key per D-039 waiver). CAPABILITY_INVENTORY.md CAP-022 recorded "iam:ListRoles shows no acdl* roles." Phase 56 re-created the role:

• Role name: acdl-act-runner-role
• ARN: arn:aws:iam::581513795199:role/acdl-act-runner-role
• Trust policy (v1): permits arn:aws:iam::581513795199:root to assume the role (sts:AssumeRole). This is the bootstrap trust — once go-gitea/gitea#36988 merges real OIDC federation, the trust policy is updated to the Gitea OIDC provider ARN + the runner's subject claim.
• Attached policy: acdl-spike-runner-policy (the same managed policy the spike-runner user uses) — so the runner inherits the spike-runner-equivalent permissions, no long-lived key needed.
• Tags: Project=acdl, Capability=CAP-022, Milestone=v1.11, ManagedBy=ciagent.

Note: Real OIDC federation (D-039) is blocked on go-gitea/gitea#36988. Phase 56 re-creates the IAM role + trust policy; act_runner adoption is out of scope for v1.11 (see REQUIREMENTS.md §Out of Scope v1.11). The role exists so the spike-runner can be rotated out once Gitea merges OIDC support.

Grant verification (Phase 56 live step, 2026-07-28)

All new grants verified effective against account 581513795199:

Service	Verification	Result
CloudFront	list_distributions	OK (0 items — stacks not yet deployed)
WAFv2	list_web_acls(CLOUDFRONT)	OK (0 items)
Lambda	list_functions	OK (0 items)
DynamoDB acdl-contracts	describe_table	ResourceNotFound (table not yet created — Phase 57 applies it; grant works, no AccessDenied)
Cost Explorer	get_cost_and_usage (7-day window)	OK (7 results — Phase 59 queries the full window)
Secrets Manager	list_secrets	OK (0 items)
SNS	list_topics	OK (0 items)
IAM OIDC role	get_role(acdl-act-runner-role)	OK (ARN confirmed)

Least-privilege scoping notes

• CloudFront/WAF/KMS/CE/OIDC use Resource: "*" because these services use account-scoped or global ARNs that cannot be resource- restricted at the statement level. Scope is bounded by the action list (e.g. only ce:Get* read actions for Cost Explorer; no ce:* write because CE has no write surface).
• Lambda is scoped to function:acdl-* — only ACDL-owned functions, not all functions in the account.
• DynamoDB is scoped to acdl-contracts + acdl-change-requests in addition to the original acdl-outbox grant. The spike-runner cannot touch other tables in the account.
• Secrets Manager is scoped to secret:acdl/* — only ACDL-owned secrets.
• SNS is scoped to acdl-* topic names.
• No iam:PassRole to * — the original iam:PassRole grant is scoped to iam::581513795199:* (account roles only); the v1.11 grant does not extend it.

Escalation (D-095 — resolved 2026-07-28)

Applying this policy required the bootstrap root key (ACDL_BOOTSTRAP_AWS_*). The original root key was closed (D-034). Per D-095 (user-confirmed: escalate to human for fresh access keys, no silent fallback), the run paused at Phase 56 live step. The user provided fresh root credentials in .env.secrets; the run resumed and applied the managed policy + re-created the OIDC role. D-095 is resolved.