fix(infra): keep ecs-task-boundary CreatePolicy off live resources (PLAT-216) (#262)

Bootstrap is an IAM factory. The boundary must not wait on DynamoDB, SQS, ECR, or the ECS log group.

terraform/iam.tf

@@ -41,8 +41,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "dynamodb:UpdateItem",
     ]
     resources = [
-      aws_dynamodb_table.shifts.arn,
+      "arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}",
-      "${aws_dynamodb_table.shifts.arn}/index/*",
+      "arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}/index/*",
     ]
   }
 
@@ -93,7 +93,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "sqs:DeleteMessage",
       "sqs:GetQueueAttributes",
     ]
-    resources = [aws_sqs_queue.jobs.arn]
+    resources = ["arn:aws:sqs:${var.aws_region}:${local.account_id}:${local.project}-jobs"]
   }
 
   dynamic "statement" {
@@ -121,7 +121,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "ecr:BatchGetImage",
       "ecr:GetDownloadUrlForLayer",
     ]
-    resources = [aws_ecr_repository.api.arn]
+    resources = ["arn:aws:ecr:${var.aws_region}:${local.account_id}:repository/${local.project}"]
   }
 
   statement {
@@ -133,8 +133,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "logs:CreateLogGroup",
     ]
     resources = [
-      aws_cloudwatch_log_group.api.arn,
+      "arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}",
-      "${aws_cloudwatch_log_group.api.arn}:*",
+      "arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}:*",
     ]
   }
 }

tests/infra/test_hcp_contract.py

@@ -85,6 +85,18 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
     assert "hcptf_apply_ecs" in HCP_IAM
 
 
+def test_ecs_task_boundary_uses_static_arns():
+    iam = (TERRAFORM / "iam.tf").read_text()
+    chunk = iam.split('data "aws_iam_policy_document" "ecs_task_boundary"')[1]
+    chunk = chunk.split("resource ")[0]
+    assert "aws_dynamodb_table.shifts" not in chunk
+    assert "aws_sqs_queue.jobs" not in chunk
+    assert "aws_ecr_repository.api" not in chunk
+    assert "aws_cloudwatch_log_group.api" not in chunk
+    assert "table/${local.table_name}" in chunk
+    assert "log-group:/ecs/${local.project}" in chunk
+
+
 def test_deploy_api_workflow_exists():
     deploy_api = (ROOT / ".github" / "workflows" / "deploy-api.yaml").read_text()
     assert "environment: ${{ needs.target.outputs.environment }}" in deploy_api