adam/afi-backup-monitor
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/afi-backup-monitor.git synced 2026-10-07 01:12:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): tighten plan-refresh and scoped boundary pin (PLAT-146)

Browse source 
Plan-refresh copied lambda:* from apply, so a plan session could mutate afi functions. Drop the unsuffixed org-wide Lambda boundary so scoped apply cannot retarget exec roles onto that ceiling.
This commit is contained in:
Adam Moussa 2026-09-02 12:19:46 -04:00
parent 3240b9e47f
commit 7fbff09f66
No known key found for this signature in database
1 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
terraform/hcp_iam.tf
View file

@ -110,7 +110,6 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
variable = "iam:PermissionsBoundary"
values = [
"arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*",
"arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary",
"arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor",
]
}
@ -131,7 +130,6 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
variable = "iam:PermissionsBoundary"
values = [
"arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*",
"arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary",
"arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor",
]
}
@ -328,9 +326,10 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
}
statement {
sid = "RefreshLambda"
effect = "Allow"
actions = ["lambda:*"]
sid = "RefreshLambda"
effect = "Allow"
# Read-only refresh for plan. Mutate APIs stay on the apply role.
actions = ["lambda:Get*", "lambda:List*"]
resources = [
"arn:aws:lambda:us-east-1:${local.account_id}:function:afi-*",
"arn:aws:lambda:us-east-1:${local.account_id}:layer:afi-shared*",