Adam Moussa cdcb6625b9 fix: BatchGetSecretValue must be on * for the filtered batch call (#23) ... The prior fix scoped secretsmanager:BatchGetSecretValue to the env-prefixed secret ARN, but the live box still got AccessDenied: batch-get-secret-value invoked WITH a name --filters is a COLLECTION call that AWS authorizes against * (a per-secret ARN does not satisfy it). Split the statement: - GetSecretValue + DescribeSecret stay PREFIX-scoped (secret:open-swe-<env>/*) — this is what gates which secret VALUES the box can read (checked per-secret in the batch). - BatchGetSecretValue + ListSecrets move to a * operation-level statement (the filtered collection call + the list action; neither is resource-scopable for this usage). VALUE isolation preserved (dev box still cannot read prod secret values); only secret NAME/metadata enumeration is widened. GPT-4.1 IAM cross-review: BLOCK none, FIX none. Suppression OSWE-IAC-SECRETS-LIST-01 updated; future hardening (explicit --secret-id-list to drop both * grants) tracked there.		2026-06-26 19:44:12 -04:00
..
ami-cache.ts	feat: stand up dev properly — assets bucket + artifact CD + baked AMI + on-box uv sync (T7+T19+T14) (#18)	2026-06-26 18:49:09 -04:00
app-service.ts	fix(deploy): use %%...%% for CDK user-data tokens (don't collide with @@ sed) (#21)	2026-06-26 19:06:37 -04:00
assets-bucket.ts	feat: stand up dev properly — assets bucket + artifact CD + baked AMI + on-box uv sync (T7+T19+T14) (#18)	2026-06-26 18:49:09 -04:00
config-store.ts	feat: Secrets Manager + SSM config store for open-swe (T11) (#10)	2026-06-26 16:07:23 -04:00
github-deploy-roles.ts	feat: stand up dev properly — assets bucket + artifact CD + baked AMI + on-box uv sync (T7+T19+T14) (#18)	2026-06-26 18:49:09 -04:00
instance-role.ts	fix: BatchGetSecretValue must be on * for the filtered batch call (#23)	2026-06-26 19:44:12 -04:00