open-swe/infra/lib/constructs/instance-role.ts

import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";
import { ACCOUNT, EnvName, REGION, prefix } from "../config";

/**
 * Least-privilege EC2 instance role for the open-swe box (one per env).
 *
 * Grants exactly what the boot/runtime flow needs and NOTHING ELSE — no admin,
 * no `*` resources except where the AWS action genuinely has no resource-level
 * scoping. Per-env so the dev box can never read prod secrets/config and vice
 * versa. Reviewed at T4 (GPT-4.1 IAM cross-review) / T5 (/sh-security-review)
 * before it is ever deployed (T6).
 */
export class InstanceRole extends Construct {
  public readonly role: iam.Role;

  constructor(scope: Construct, id: string, env: EnvName) {
    super(scope, id);
    const p = prefix(env);

    this.role = new iam.Role(this, "Role", {
      roleName: `${p}-instance-role`,
      assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
      description: `EC2 instance role for the ${p} open-swe box (least-privilege).`,
    });

    // AWS-managed: lets the SSM agent register the instance and RECEIVE the
    // app-deploy `ssm:SendCommand` from githubdeploy-open-swe-app. This is the
    // standard Session-Manager / RunCommand grant and is the only managed
    // policy on the role. DELIBERATE — flag for T4 confirmation.
    this.role.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
    );

    // Read the build artifact from the env's S3 asset bucket (deploy = pull).
    // Scoped to releases/* — the only prefix CI writes and the box pulls — so a
    // compromised box (or stolen IMDS creds) cannot read anything else that might
    // ever land in the bucket (least-privilege; mirrors the app role's write scope).
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadArtifactObjects",
        actions: ["s3:GetObject"],
        resources: [`arn:aws:s3:::${p}-assets/releases/*`],
      }),
    );
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ListArtifactBucket",
        actions: ["s3:ListBucket", "s3:GetBucketLocation"],
        resources: [`arn:aws:s3:::${p}-assets`],
      }),
    );

    // Read non-sensitive config from SSM Parameter Store under /open-swe-<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSsmConfig",
        actions: ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
        resources: [`arn:aws:ssm:${REGION}:${ACCOUNT}:parameter/${p}/*`],
      }),
    );

    // VALUE access — Secrets Manager under open-swe-<env>/*. Secret ARNs carry a
    // random 6-char suffix, hence the trailing `*`. This is the statement that
    // actually gates which secret VALUES the box can read: prefix-scoped, so the
    // dev box can never read prod secret values (and vice versa). GetSecretValue is
    // checked per-secret even when the value is returned via the batch call below.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSecretValues",
        actions: ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
        resources: [`arn:aws:secretsmanager:${REGION}:${ACCOUNT}:secret:${p}/*`],
      }),
    );

    // OPERATION-level grants for fetch-config.sh's prefix-FILTERED batch read
    // (`batch-get-secret-value --filters Key=name,Values=open-swe-<env>/`). Both of
    // these are collection operations that AWS authorizes against `*`, NOT a
    // per-secret ARN: BatchGetSecretValue with a filter is a collection call (a
    // prefix-scoped ARN does NOT satisfy it — it AccessDenies), and ListSecrets is a
    // list action with no resource-level scoping at all. Neither returns or widens
    // VALUE access: a secret's value is still only returned when the prefix-scoped
    // GetSecretValue above allows it, so cross-env VALUE isolation is preserved. The
    // residual is metadata-only (the box can ENUMERATE secret names account-wide).
    // Future hardening to drop both `*` grants: switch fetch-config to an explicit
    // `--secret-id-list` (no filter), which lets BatchGetSecretValue be prefix-scoped
    // and needs no ListSecrets. Tracked as OSWE-IAC-SECRETS-LIST-01.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "SecretsBatchListOps",
        actions: ["secretsmanager:BatchGetSecretValue", "secretsmanager:ListSecrets"],
        resources: ["*"],
      }),
    );

    // NOTE (T11): SSM SecureString + Secrets Manager here are assumed to use the
    // AWS-managed keys (alias/aws/ssm, alias/aws/secretsmanager) for which the
    // service grants Decrypt implicitly — so NO kms:Decrypt is granted. If T11
    // moves these to a customer CMK, add a scoped `kms:Decrypt` on that key ARN
    // ONLY (not `*`).

    // Ship application logs to CloudWatch Logs under /open-swe/<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "PutAppLogs",
        actions: [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogStreams",
        ],
        resources: [
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*`,
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*:*`,
        ],
      }),
    );
  }
}