The bootstrap IAM stack (oidc-deploy-roles.yaml) had no README coverage:
how to deploy it manually (no CD pipeline; >51KB needs --s3-bucket), the
scoped github-cfn-execution-role contract, and the
seahaven-lambda-execution-boundary ceiling for SAM Lambda roles.
Documents the INFRA-97 / INFRA-103 work.
The CFN execution role held IAMFullAccess + seven *FullAccess managed
policies, giving it unconstrained AWS admin access. This replaces all
of those with per-service inline statements covering exactly what the
five SAM stacks require during a CloudFormation deploy.
PRIMARY ESCALATION CONTROL: iam:CreateRole, iam:AttachRolePolicy, and
iam:PutRolePolicy are now conditioned on iam:PermissionsBoundary
StringEquals the seahaven-lambda-execution-boundary ARN. Any role the
CFN execution role creates must carry that boundary, capping its
effective permissions at the boundary's ceiling.
SAM RolePath note: AWS::Serverless::Function does not support a custom
RolePath on auto-generated execution roles. Path scoping (e.g.
/cfn-managed/) cannot be used as the escalation guard for SAM auto-roles.
The iam:PermissionsBoundary condition achieves the same security goal.
DEPLOY ORDER DEPENDENCY: the seahaven-lambda-execution-boundary policy
(INFRA-103, PR #45) MUST exist before this stack is deployed. See the
PR description for the mandatory three-step deploy sequence.
Refs: INFRA-97
* Add seahaven-lambda-execution-boundary managed policy
Lambda execution roles auto-generated by SAM have no ceiling today —
a misconfigured Policies block could grant excessive permissions that
persist at runtime. This boundary caps every SAM function execution
role at the union of what the five stacks actually need, so the
effective permissions are always the intersection of the role's own
policies and this document.
The policy is a deliberate superset rather than exact-minimum: being
slightly broad is safer than a boundary that breaks functions at
runtime. Per-service scoping will tighten in follow-up work.
SAM template agents: add
PermissionsBoundary: arn:aws:iam::328440206208:policy/seahaven-lambda-execution-boundary
to Globals.Function in all five stacks after this stack deploys.
Refs: INFRA-103
* Fix boundary gaps found in GPT-4.1 cross-review
Three issues from the mandatory IAM cross-review (BLOCK/FIX):
1. Add KMS statement — PaymentsDashboard DynamoDB table and
payments-dashboard CloudWatch log groups use CMKs. Without
kms:Decrypt + kms:GenerateDataKey in the boundary, those Lambda
calls fail at the KMS layer at runtime. Scoped to account keys only.
2. Add table/*/index/* to DynamoDB resource — dynamodb:Query on a GSI
requires the index ARN; covering only table/* silently denied GSI
queries at the boundary.
3. Fix EC2 ENI statement — remove AssignPrivateIpAddresses /
UnassignPrivateIpAddresses (EFA-only, not part of Lambda ENI
lifecycle); add DescribeSubnets + DescribeSecurityGroups + DescribeVpcs
which are required by the Lambda service during VPC attachment and are
present in AWSLambdaVPCAccessExecutionRole.
4. Add SES configuration-set/* resource — ses:SendRawEmail requires
permission on the configuration set if one is passed at send time.
Refs: INFRA-103
The org ruleset now requires 1 approving review + code-owner review, so
auto-merge can never complete without a human approval — the workflow
only added a no-op (or erroring) check to every PR. Repo-level 'Allow
auto-merge' was also disabled on several repos, making the gh pr merge
--auto call fail benignly. The required-workflow rule referencing this
file was removed from org ruleset 15869156 first.
The group key ci-${{ github.workflow }}-${{ github.ref }} resolves
identically for every job in a caller workflow (github.workflow is the
caller's name in a reusable workflow), so repos calling two reusable CI
workflows from one ci.yaml (e.g. exec-aide python + typescript) had
their jobs cancel each other on every run.
Prefix each group with the reusable workflow's own filename and append
its distinguishing input (source-dirs / working-directory) so sibling
jobs get distinct groups while superseded runs of the same job still
cancel.
Callers grant no explicit permissions, so they pass the org default
read-only token. A reusable workflow cannot request more than its
caller grants, causing startup_failure on every dependency-review run.
dependency-review-action only needs contents: read when not posting
PR comments.
Replace mutable v1 tag references with immutable commit SHAs so a
compromised or force-moved tag cannot inject code into reusable
workflows. Each pin keeps a # v1 comment for readability.
- claude-code-action in compliance-audit.yaml
- ruby/setup-ruby in cd-mobile-ios.yaml (v1 branch)
Superseded CI runs on the same ref keep consuming runners and delay
feedback on the latest push. Add a job-level concurrency group keyed
on github.workflow and github.ref so a new push cancels the in-flight
CI run for that branch.
Concurrency is set at the job level rather than the workflow level
because these are workflow_call reusable workflows: workflow-level
concurrency would resolve github.workflow against the caller's context,
collapsing unrelated callers into one group. cd-* deploy workflows are
intentionally left untouched to avoid cancelling in-flight deploys.
Bump all aws-actions/configure-aws-credentials references to @v6 (org
target) across the reusable CD workflows. v6 is the verified org standard
alongside actions/checkout@v6.
Ref: engineering-handbook cicd.md (workflow standardization).
Bump all actions/checkout references to @v6 (org target). v4 runs on a
node runtime version that is being deprecated; v6 is the verified org
standard alongside configure-aws-credentials@v6.
Ref: engineering-handbook cicd.md (workflow standardization).
Set @amoussa1229 as the default owner for all paths so the new
required code-owner review rule on the org main-branch ruleset has
a reviewer to resolve against. The .github repo CODEOWNERS acts as
the org-wide fallback for repos without their own file.
Add a reusable callable-dependency-review workflow that runs
actions/dependency-review-action with fail-on-severity: high, and
append a Sea Haven checklist to the PR template covering infra,
secrets, PITR, Slack, Confluence, memory, and cross-review.
Codifies the handbook PR description format (Summary/Validation/Tests/
Notes) as the default template GitHub prefills for every repo in the org
that lacks its own. Hidden hint comments carry the title, scope, and Jira
linking conventions so contributors fill in structure instead of a blank
box.
Adds read + (dis)associate wafv2 actions so SAM/CFN deploys can attach the shared
seahaven-app-waf CloudFront WebACL to app distributions (meal-order orders).
Without it, the WebACL association fails 'Unable to verify read permissions on
Web ACL'. IAM cross-reviewed (no BLOCK). Not wafv2:* — scoped to read +
associate. Same manual-changeset deploy path as the H-16 change.
The SAM template secret check grepped the 5 lines after `Environment:` for
API_KEY|SECRET|TOKEN|PASSWORD|WEBHOOK. That flags env var *names* like
`SLACK_BOT_TOKEN_SECRET: my-app/slack-token`, whose value is a Secrets
Manager id — i.e. the recommended pattern — so any well-architected
template failed CI.
Match on the value's shape instead: known inline secret formats (Slack
xox* tokens, AWS AKIA keys, GitHub gh*_/PAT tokens, sk- keys, PEM private
keys). Secrets Manager references and intrinsic functions no longer trip
it, while pasted real secrets still fail the build.
- New githubdeploy-seahaven-account-baseline OIDC role (CDK pattern: assumes
cdk-hnb659fds-*, scoped to the repo's main branch). Wires CD for the shared
account-baseline repo (CloudTrail C-1 + AWS Backup C-7).
- Codify cloudfront:* and ssm:* on github-cfn-execution-role to reconcile
out-of-band drift (audit H-16). These are needed by live SAM deploys
(meal-order CloudFront; afterhours/payments/meal-order SSM params).
Deployed via change set wire-account-baseline-and-h16; stack now IN_SYNC.
IAM cross-review completed (new role confirmed; cfn-exec breadth documented).
Mirrors the existing per-repo deploy roles (StringLike sub claim, scoped to
repo:<org>/apm-wo-analysis:ref:refs/heads/main, sts:AssumeRole on
cdk-hnb659fds-* only). Cross-reviewed (cross_reviewer): additive, no existing
role modified; the one flagged item (StringLike->StringEquals) was a false
positive — all 8 existing roles use StringLike, so this is consistent.
Extend ci-typescript-cdk and cd-cdk with working-directory,
dotnet pre-build, and post-deploy script inputs. Add new
ci-dotnet and cd-mobile-ios reusable workflows.
Double backslash in single quotes makes ERE match a literal
backslash instead of a dot. No .gitignore entry could pass
this check. Affects both CDK and SAM CI workflows.
* Add QEMU support to CI CDK workflow for cross-platform Docker builds
Mirrors the enable-qemu input from cd-cdk.yaml. Required when CDK
stacks use PythonFunction or other Docker-bundled constructs targeting
arm64 Lambda on x86 CI runners.
* Increase CI timeout for QEMU CDK builds
* Bump default Node.js version to 24 across all reusable workflows
npm 11 (Node 24) generates lockfileVersion 3 which breaks npm ci
on Node 22's npm 10 for repos with aws-cdk-lib bundled deps.
* Add lightweight conventions check to CI workflows
Validates README exists, .env in .gitignore, arm64 architecture,
and log retention in synthesized templates. Runs by default,
opt-out via run-conventions-check: false.
* Add pre-flight stack status checks to CD workflows
Blocks deploy if the CloudFormation stack is in ROLLBACK_COMPLETE,
FAILED, or IN_PROGRESS state. Prevents wasted deploy attempts on
stacks that need manual intervention.
* Add post-deploy health checks to CD workflows
Verifies stack status after deploy, prints outputs, and runs
project-specific scripts/health-check.sh if present.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Mirrors the enable-qemu input from cd-cdk.yaml. Required when CDK
stacks use PythonFunction or other Docker-bundled constructs targeting
arm64 Lambda on x86 CI runners.
Use GitHub App token (CLAUDE_CI_APP_ID) for cross-repo access when
dispatching reviews via workflow_dispatch. Remove issue_comment,
pull_request_review_comment, and review_requested triggers since
org-level workflows don't propagate those events to other repos.
* Change Claude Code review to on-demand via @claude or review request
Replace automatic PR triggers (opened, ready_for_review) with on-demand
triggers: @claude mentions in PR comments, inline review comments, and
review requests from the 'claude' team.
* Remove unreachable workflow_call event check
workflow_call invocations inherit the caller's event_name, so
github.event_name == 'workflow_call' never matches. The caller's
event context passes through and is handled by the existing
issue_comment/review_requested conditions.
* Fix workflow_call invocations being silently skipped
Add a direct_call boolean input (defaults to true) to workflow_call
so reusable workflow callers bypass the event-specific filtering gate.
Without this, callers triggered by e.g. pull_request opened would
hit the pull_request branch which requires requested_team.slug == 'claude',
causing a silent no-op.
* Fix compliance audit workflow and source standards from handbook
- Add missing permissions (id-token, contents, issues) for OIDC auth
and issue creation
- Fix direct_prompt → prompt (direct_prompt is not a valid input)
- Check out engineering-handbook repo as authoritative standards source
instead of hardcoding the checklist in the workflow
- Create compliance label on-the-fly if it doesn't exist in target repo
* Fix compliance audit violation detection
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
- SQS/EC2/SNS as inline policy (managed policy quota is 10)
- cd-sam.yaml now accepts optional parameter-overrides input for
SAM templates with required parameters
- Add cloudformation:CreateChangeSet on aws:transform/* to the shared
CFN execution role (required for SAM's Serverless transform)
- Remove working-directory from pip install step so it finds
requirements.txt at repo root (not just cdk-dir)
Enables Python CDK repos (po-ingest, workorder-ingest) to use the
same reusable workflow. Adds run-cdk-synth, cdk-dir, and node-version
inputs. Refactors dependency install to be shared between pytest and
cdk synth paths.
Parameterized workflows that each repo calls via a thin 3-5 line
caller. All lint, test, and validate steps are toggleable so repos
can adopt incrementally. Covers Python SAM, Python CDK, TypeScript
CDK, and Node.js SAM stacks.
