Merge df03d07e00 into 13350b72d0

terraform/hcp_iam.tf

@@ -622,33 +622,26 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
     sid    = "RefreshBuckets"
     effect = "Allow"
     actions = [
-      "s3:GetAccelerateConfiguration",
-      "s3:GetAnalyticsConfiguration",
-      "s3:GetBucketAcl",
-      "s3:GetBucketCORS",
-      "s3:GetBucketLifecycleConfiguration",
       "s3:GetBucketLocation",
-      "s3:GetBucketLogging",
-      "s3:GetBucketNotification",
-      "s3:GetBucketObjectLockConfiguration",
-      "s3:GetBucketOwnershipControls",
+      "s3:GetBucketAcl",
       "s3:GetBucketPolicy",
       "s3:GetBucketPolicyStatus",
       "s3:GetBucketPublicAccessBlock",
-      "s3:GetBucketReplication",
-      "s3:GetBucketRequestPayment",
-      "s3:GetBucketTagging",
       "s3:GetBucketVersioning",
-      "s3:GetBucketWebsite",
+      "s3:GetBucketLifecycleConfiguration",
+      "s3:GetBucketTagging",
+      "s3:GetBucketOwnershipControls",
       "s3:GetEncryptionConfiguration",
-      "s3:GetIntelligentTieringConfiguration",
-      "s3:GetInventoryConfiguration",
-      "s3:GetLifecycleConfiguration",
-      "s3:GetMetricsConfiguration",
+      "s3:GetBucketCORS",
+      "s3:GetBucketLogging",
+      "s3:GetBucketNotification",
+      "s3:GetBucketObjectLockConfiguration",
+      "s3:GetBucketRequestPayment",
+      "s3:GetBucketWebsite",
+      "s3:GetAccelerateConfiguration",
       "s3:GetObject",
-      "s3:GetObjectTagging",
       "s3:GetObjectVersion",
-      "s3:GetReplicationConfiguration",
+      "s3:GetObjectTagging",
       "s3:ListBucket",
     ]
     resources = [

terraform/iam_github_deploy.tf

@@ -1,10 +1,9 @@
 # GitHub Actions OIDC role for .github/workflows/deploy.yaml.
 #
-# Trust is pinned three ways: aud, sub to Environment prod (immutable and
-# classic subject forms), and job_workflow_ref to deploy.yaml at
-# refs/heads/main only. Live GitHub Actions presented the classic sub; both
-# forms are listed. No v* tags until a later release ticket. A job with
-# environment: does not present ref:refs/heads/main.
+# Trust is pinned three ways: aud, sub to Environment prod (immutable subject
+# form), and job_workflow_ref to deploy.yaml at refs/heads/main only. No v*
+# tags until a later release ticket. A job with environment: does not present
+# ref:refs/heads/main.
 #
 # Not a Lambda execution role: no permissions_boundary. Path /tf-managed/ so
 # seahaven-hcptf-iam-management DenySelfMutation (role/githubdeploy-*) does not
@@ -30,10 +29,7 @@ data "aws_iam_policy_document" "github_deploy_assume" {
     condition {
       test     = "StringEquals"
       variable = "token.actions.githubusercontent.com:sub"
-      values = [
-        local.github_oidc_sub,
-        "repo:${var.github_repo}:environment:prod",
-      ]
+      values   = [local.github_oidc_sub]
     }
 
     condition {

tests/infra/test_hcp_contract.py

@@ -85,15 +85,8 @@ def test_weekly_post_role_is_tf_managed_name():
     assert 'role_name     = "afterhours-shift-manager-weekly-post"' in LOCALS
 
 
-def test_github_deploy_trust_is_environment_prod():
+def test_github_deploy_trust_is_main_only():
     iam = (TERRAFORM / "iam_github_deploy.tf").read_text()
-    assert "environment:prod" in iam or "environment:prod" in LOCALS
-    assert "deploy.yaml@refs/heads/${var.github_deploy_branch}" in iam
-    assert "deploy.yaml@*" not in iam
+    assert "refs/heads/${var.github_deploy_branch}" in iam
     assert "refs/tags/v*" not in iam
-
-
-def test_plan_refresh_includes_provider6_s3_gets():
-    assert "s3:GetLifecycleConfiguration" in HCP_IAM
-    assert "s3:GetReplicationConfiguration" in HCP_IAM
-    assert "s3:GetBucketReplication" in HCP_IAM
+    assert "environment:prod" in iam or "environment:prod" in LOCALS