adam/afterhours-shift-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git synced 2026-09-30 05:33:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(infra): keep ecs-task-boundary CreatePolicy off live resources (PLAT-216)

Browse source 
Bootstrap is an IAM factory. The boundary must not wait on DynamoDB, SQS, ECR, or the ECS log group.
This commit is contained in:
Adam Moussa 2026-09-21 15:53:52 -04:00
parent d49c4bb4f2
commit 581a8683e3
No known key found for this signature in database
2 changed files with 18 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
terraform/iam.tf
View file

@ -41,8 +41,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"dynamodb:UpdateItem",
]
resources = [
aws_dynamodb_table.shifts.arn,
"${aws_dynamodb_table.shifts.arn}/index/*",
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}",
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}/index/*",
]
}
@ -93,7 +93,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"sqs:DeleteMessage",
"sqs:GetQueueAttributes",
]
resources = [aws_sqs_queue.jobs.arn]
resources = ["arn:aws:sqs:${var.aws_region}:${local.account_id}:${local.project}-jobs"]
}
dynamic "statement" {
@ -121,7 +121,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer",
]
resources = [aws_ecr_repository.api.arn]
resources = ["arn:aws:ecr:${var.aws_region}:${local.account_id}:repository/${local.project}"]
}
statement {
@ -133,8 +133,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
"logs:CreateLogGroup",
]
resources = [
aws_cloudwatch_log_group.api.arn,
"${aws_cloudwatch_log_group.api.arn}:*",
"arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}",
"arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}:*",
]
}
}

12
tests/infra/test_hcp_contract.py
View file

@ -85,6 +85,18 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
assert "hcptf_apply_ecs" in HCP_IAM
def test_ecs_task_boundary_uses_static_arns():
iam = (TERRAFORM / "iam.tf").read_text()
chunk = iam.split('data "aws_iam_policy_document" "ecs_task_boundary"')[1]
chunk = chunk.split("resource ")[0]
assert "aws_dynamodb_table.shifts" not in chunk
assert "aws_sqs_queue.jobs" not in chunk
assert "aws_ecr_repository.api" not in chunk
assert "aws_cloudwatch_log_group.api" not in chunk
assert "table/${local.table_name}" in chunk
assert "log-group:/ecs/${local.project}" in chunk
def test_deploy_api_workflow_exists():
deploy_api = (ROOT / ".github" / "workflows" / "deploy-api.yaml").read_text()
assert "environment: ${{ needs.target.outputs.environment }}" in deploy_api