adam/meal-order-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/meal-order-manager.git synced 2026-10-07 02:21:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): attach per-workload lambda permissions boundary (PLAT-52)

Browse source
This commit is contained in:
Adam Moussa 2026-08-20 14:31:28 -04:00
parent a247f2f45a
commit b91d7f3745
No known key found for this signature in database
3 changed files with 13 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
terraform/iam.tf
View file

@ -1,10 +1,10 @@
# Execution roles for the seven Lambda functions plus the API Gateway role that # Execution roles for the seven Lambda functions plus the API Gateway role that
# invokes the admin authorizer. # invokes the admin authorizer.
# #
# Every role is created under the /tf-managed/ path and carries the account's # Every Lambda execution role is created under the /tf-managed/ path and
# seahaven-lambda-execution-boundary permissions boundary. The path is what # carries seahaven-lambda-execution-boundary-meal-order-manager (PLAT-52).
# distinguishes Terraform-owned roles from the /cfn-managed/ roles the retired # The path distinguishes Terraform-owned roles from the retired SAM
# SAM stack created. # /cfn-managed/ roles.
# #
# The inline policies below are hand-expanded from the SAM policy templates in # The inline policies below are hand-expanded from the SAM policy templates in
# template.yaml (DynamoDBCrudPolicy, DynamoDBReadPolicy, S3CrudPolicy, # template.yaml (DynamoDBCrudPolicy, DynamoDBReadPolicy, S3CrudPolicy,

10
terraform/iam_github_weekly_menu.tf
View file

@ -43,11 +43,13 @@ data "aws_iam_policy_document" "weekly_menu_assume" {
} }
resource "aws_iam_role" "weekly_menu" { resource "aws_iam_role" "weekly_menu" {
name = "githubdeploy-meal-order-manager-weekly-menu" name = "githubdeploy-meal-order-manager-weekly-menu"
path = "/tf-managed/" path = "/tf-managed/"
description = "GitHub Actions weekly-menu scrape/publish for meal-order-manager" description = "GitHub Actions weekly-menu scrape/publish for meal-order-manager"
# Not a Lambda execution role. Do not attach seahaven-lambda-execution-boundary
# (PLAT-52). HCP apply cannot DeleteRolePermissionsBoundary (DenyBoundaryTampering);
# stripping the live attachment is an administrator action after this apply.
assume_role_policy = data.aws_iam_policy_document.weekly_menu_assume.json assume_role_policy = data.aws_iam_policy_document.weekly_menu_assume.json
permissions_boundary = local.boundary_arn
max_session_duration = 3600 max_session_duration = 3600
} }

6
terraform/locals.tf
View file

@ -2,9 +2,9 @@ locals {
project = "meal-order-manager" project = "meal-order-manager"
account_id = "011934824531" account_id = "011934824531"
# Every execution role in this configuration is created under /tf-managed/ and # Lambda execution roles under /tf-managed/ carry the per-workload ceiling
# carries the account's Lambda execution boundary. # (PLAT-52). githubdeploy-meal-order-manager-weekly-menu must not.
boundary_arn = "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary" boundary_arn = "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-meal-order-manager"
form_bucket_name = "${local.project}-form-${local.account_id}" form_bucket_name = "${local.project}-form-${local.account_id}"
reports_bucket_name = "${local.project}-reports-${local.account_id}" reports_bucket_name = "${local.project}-reports-${local.account_id}"