adam/afterhours-shift-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git synced 2026-09-30 06:43:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(infra): keep ecs-task-boundary CreatePolicy off live resources (PLAT-216) (#262)
Some checks are pending
Deploy API / Resolve target (push) Waiting to run
Details
Deploy API / Deploy API to (push) Blocked by required conditions
Details
Deploy / Deploy to prod (push) Waiting to run
Details

Browse source 
Bootstrap is an IAM factory. The boundary must not wait on DynamoDB, SQS, ECR, or the ECS log group.
This commit is contained in:
Adam Moussa 2026-09-21 19:57:12 +00:00 • committed by GitHub
parent d49c4bb4f2
commit 1362a6cd90
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
terraform/iam.tf
View file

@ -41,8 +41,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"dynamodb:UpdateItem",
]
resources = [
aws_dynamodb_table.shifts.arn,
"${aws_dynamodb_table.shifts.arn}/index/*",
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}",
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}/index/*",
]
}
@ -93,7 +93,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"sqs:DeleteMessage",
"sqs:GetQueueAttributes",
]
resources = [aws_sqs_queue.jobs.arn]
resources = ["arn:aws:sqs:${var.aws_region}:${local.account_id}:${local.project}-jobs"]
}
dynamic "statement" {
@ -121,7 +121,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer",
]
resources = [aws_ecr_repository.api.arn]
resources = ["arn:aws:ecr:${var.aws_region}:${local.account_id}:repository/${local.project}"]
}
statement {
@ -133,8 +133,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"logs:CreateLogGroup",
]
resources = [
aws_cloudwatch_log_group.api.arn,
"${aws_cloudwatch_log_group.api.arn}:*",
"arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}",
"arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}:*",
]
}
}

12
tests/infra/test_hcp_contract.py
View file

@ -85,6 +85,18 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
assert "hcptf_apply_ecs" in HCP_IAM
def test_ecs_task_boundary_uses_static_arns():
iam = (TERRAFORM / "iam.tf").read_text()
chunk = iam.split('data "aws_iam_policy_document" "ecs_task_boundary"')[1]
chunk = chunk.split("resource ")[0]
assert "aws_dynamodb_table.shifts" not in chunk
assert "aws_sqs_queue.jobs" not in chunk
assert "aws_ecr_repository.api" not in chunk
assert "aws_cloudwatch_log_group.api" not in chunk
assert "table/${local.table_name}" in chunk
assert "log-group:/ecs/${local.project}" in chunk
def test_deploy_api_workflow_exists():
deploy_api = (ROOT / ".github" / "workflows" / "deploy-api.yaml").read_text()
assert "environment: ${{ needs.target.outputs.environment }}" in deploy_api