adam/meal-order-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/meal-order-manager.git synced 2026-09-30 05:23:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): drop githubdeploy workflow_ref OIDC condition (PLAT-222) (#215)
Some checks failed
Deploy API / Deploy API to dev (push) Has been cancelled
Details
Deploy API / Deploy API to prod (push) Has been cancelled
Details

Browse source 
* fix(iam): drop githubdeploy workflow_ref OIDC condition

AWS STS does not evaluate GitHub workflow_ref, so that trust condition fail-closes AssumeRoleWithWebIdentity.

* chore(security): retarget githubdeploy Checkov suppression

Dropping the workflow_ref trust condition shifted CKV_AWS_111 from line 49 to 42. Permissions are unchanged.

* style: apply formatter

---------

Co-authored-by: sea-haven-auto-fix[bot] <5037331+sea-haven-auto-fix[bot]@users.noreply.github.com>
This commit is contained in:
Adam Moussa 2026-09-22 21:30:25 +00:00 • committed by GitHub
parent f632020b20
commit f7957436bd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 7 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.security-review/suppressions.json
View file

@ -9,8 +9,8 @@
"justification": "The meals API ALB is the CloudFront HTTP origin for orders.seahaven.com. TLS and WAF terminate at CloudFront. Restricting the security group to the CloudFront managed prefix list would block GitHub-hosted weekly-menu HMAC publish, which must call the origin with X-Meals-Publish-Key. Application gates are HMAC on /api/publish, Cognito or Google Bearer on admin, and public submit only. Accepted as the HTTP-origin design for PLAT-215; TLS on the ALB is a follow-up." "justification": "The meals API ALB is the CloudFront HTTP origin for orders.seahaven.com. TLS and WAF terminate at CloudFront. Restricting the security group to the CloudFront managed prefix list would block GitHub-hosted weekly-menu HMAC publish, which must call the origin with X-Meals-Publish-Key. Application gates are HMAC on /api/publish, Cognito or Google Bearer on admin, and public submit only. Accepted as the HTTP-origin design for PLAT-215; TLS on the ALB is a follow-up."
}, },
{ {
"id": "checkov-CKV_AWS_111-49", "id": "checkov-CKV_AWS_111-42",
"justification": "LINE SHIFT ONLY: the OIDC dual-claim change adds a workflow_ref condition and retargets job_workflow_ref, shifting github_deploy from 40 to 49. The permission document is unchanged. Original justification: githubdeploy-meal-order-manager needs ecr:GetAuthorizationToken and ecs:RegisterTaskDefinition, both of which AWS documents as Resource *. Trust is pinned to environment:dev or environment:prod, job_workflow_ref on org cd-hcp-fargate.yaml@*, and workflow_ref on the thin deploy-api.yaml caller at refs/heads/main or refs/tags/v*. iam:PassRole is limited to the ECS task and execution roles. ECR push and SSM parameter reads are already resource-scoped." "justification": "LINE SHIFT ONLY: dropping the workflow_ref trust condition shifts github_deploy from 49 to 42. The permission document is unchanged. Original justification: githubdeploy-meal-order-manager needs ecr:GetAuthorizationToken and ecs:RegisterTaskDefinition, both of which AWS documents as Resource *. Trust is pinned to environment:dev or environment:prod and job_workflow_ref on org cd-hcp-fargate.yaml@*. iam:PassRole is limited to the ECS task and execution roles. ECR push and SSM parameter reads are already resource-scoped."
} }
] ]
} }

11
terraform/iam_github_deploy.tf
View file

@ -27,6 +27,8 @@ data "aws_iam_policy_document" "github_deploy_assume" {
] ]
} }
# AWS STS GitHub condition keys include job_workflow_ref, not workflow_ref.
# A workflow_ref condition fail-closes AssumeRoleWithWebIdentity.
condition { condition {
test = "StringLike" test = "StringLike"
variable = "token.actions.githubusercontent.com:job_workflow_ref" variable = "token.actions.githubusercontent.com:job_workflow_ref"
@ -34,15 +36,6 @@ data "aws_iam_policy_document" "github_deploy_assume" {
"Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*", "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*",
] ]
} }
condition {
test = "StringLike"
variable = "token.actions.githubusercontent.com:workflow_ref"
values = [
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main",
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*",
]
}
} }
} }

23
tests/test_terraform_github_deploy.py
View file

@ -1,4 +1,4 @@
"""githubdeploy OIDC trust pins the org reusable and the thin caller.""" """githubdeploy OIDC trust pins the org reusable with AWS-supported claims."""
from pathlib import Path from pathlib import Path
@ -13,23 +13,6 @@ def test_github_deploy_trust_uses_org_reusable_and_caller():
assert ( assert (
"Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*" in text "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*" in text
) )
assert "token.actions.githubusercontent.com:workflow_ref" in text assert "token.actions.githubusercontent.com:job_workflow_ref" in text
assert ( assert "token.actions.githubusercontent.com:workflow_ref" not in text
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main"
in text
)
assert (
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*"
in text
)
assert "cd-hcp-spa.yaml" not in text
assert "token.actions.githubusercontent.com:workflow_ref" in text
assert (
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main"
in text
)
assert (
"Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*"
in text
)
assert "cd-hcp-spa.yaml" not in text assert "cd-hcp-spa.yaml" not in text