open-swe/infra/lib/constructs/instance-role.ts

import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";
import { ACCOUNT, EnvName, REGION, prefix } from "../config";

/**
 * Least-privilege EC2 instance role for the open-swe box (one per env).
 *
 * Grants exactly what the boot/runtime flow needs and NOTHING ELSE — no admin,
 * no `*` resources except where the AWS action genuinely has no resource-level
 * scoping. Per-env so the dev box can never read prod secrets/config and vice
 * versa. Reviewed at T4 (GPT-4.1 IAM cross-review) / T5 (/sh-security-review)
 * before it is ever deployed (T6).
 */
export class InstanceRole extends Construct {
  public readonly role: iam.Role;

  constructor(scope: Construct, id: string, env: EnvName) {
    super(scope, id);
    const p = prefix(env);

    this.role = new iam.Role(this, "Role", {
      roleName: `${p}-instance-role`,
      assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
      description: `EC2 instance role for the ${p} open-swe box (least-privilege).`,
    });

    // AWS-managed: lets the SSM agent register the instance and RECEIVE the
    // app-deploy `ssm:SendCommand` from githubdeploy-open-swe-app. This is the
    // standard Session-Manager / RunCommand grant and is the only managed
    // policy on the role. DELIBERATE — flag for T4 confirmation.
    this.role.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
    );

    // Read the build artifact from the env's S3 asset bucket (deploy = pull).
    // Scoped to releases/* — the only prefix CI writes and the box pulls — so a
    // compromised box (or stolen IMDS creds) cannot read anything else that might
    // ever land in the bucket (least-privilege; mirrors the app role's write scope).
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadArtifactObjects",
        actions: ["s3:GetObject"],
        resources: [`arn:aws:s3:::${p}-assets/releases/*`],
      }),
    );
    // ListBucket is constrained to the releases/ prefix (F-1/IAC-04) — the box
    // only ever lists release artifacts, so a compromised box cannot enumerate
    // any other object that might land in the bucket. GetBucketLocation has no
    // s3:prefix in its request context, so it stays a separate, unconditioned
    // statement (the condition would otherwise AccessDeny it).
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ListArtifactBucket",
        actions: ["s3:ListBucket"],
        resources: [`arn:aws:s3:::${p}-assets`],
        conditions: { StringLike: { "s3:prefix": ["releases/*"] } },
      }),
    );
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "GetArtifactBucketLocation",
        actions: ["s3:GetBucketLocation"],
        resources: [`arn:aws:s3:::${p}-assets`],
      }),
    );

    // Read non-sensitive config from SSM Parameter Store under /open-swe-<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSsmConfig",
        actions: ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
        resources: [`arn:aws:ssm:${REGION}:${ACCOUNT}:parameter/${p}/*`],
      }),
    );

    // VALUE access — Secrets Manager under open-swe-<env>/*. Secret ARNs carry a
    // random 6-char suffix, hence the trailing `*`. This is the statement that
    // actually gates which secret VALUES the box can read: prefix-scoped, so the
    // dev box can never read prod secret values (and vice versa). GetSecretValue is
    // checked per-secret even when the value is returned via the batch call below.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSecretValues",
        actions: ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
        resources: [`arn:aws:secretsmanager:${REGION}:${ACCOUNT}:secret:${p}/*`],
      }),
    );

    // BatchGetSecretValue MUST be granted on `*` — it is a collection action that
    // AWS authorizes against the account, NOT the per-secret ARN, REGARDLESS of
    // whether the caller uses `--filters` or `--secret-id-list`. A prefix-scoped
    // BatchGetSecretValue AccessDenies the whole call ("no identity-based policy
    // allows the secretsmanager:BatchGetSecretValue action") — VERIFIED on the live
    // dev box 2026-06-29 (the OSWE-IAC-SECRETS-LIST-01 attempt to prefix-scope it
    // crash-looped the box once the prior broad grant's eventual-consistency lapsed).
    // This `*` does NOT widen VALUE access: a secret value is only returned when the
    // prefix-scoped GetSecretValue above also allows it, so cross-env value isolation
    // holds. The win that DID survive: fetch-config uses `--secret-id-list` (explicit
    // names, no name filter), so `secretsmanager:ListSecrets` is NOT needed and is
    // intentionally omitted — the box cannot enumerate secret names account-wide.
    // F-2 (accepted residual): because the grant is `*`, a caller naming a secret
    // in ANOTHER env's prefix learns whether that name EXISTS (an existence oracle
    // via the per-secret AccessDenied-vs-not signal) even though the VALUE stays
    // gated by the prefix-scoped GetSecretValue above. Accepted within Sea Haven's
    // single-tenant account 328440206208 — cross-env VALUE isolation is preserved.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "BatchGetSecretValues",
        actions: ["secretsmanager:BatchGetSecretValue"],
        resources: ["*"],
      }),
    );

    // NOTE (T11): SSM SecureString + Secrets Manager here are assumed to use the
    // AWS-managed keys (alias/aws/ssm, alias/aws/secretsmanager) for which the
    // service grants Decrypt implicitly — so NO kms:Decrypt is granted. If T11
    // moves these to a customer CMK, add a scoped `kms:Decrypt` on that key ARN
    // ONLY (not `*`).

    // Invoke the Bedrock Claude model. DEFAULT_MODEL_ID is
    // `bedrock_converse:us.anthropic.claude-opus-4-8`, and the model runs in the
    // LangGraph server PROCESS on this box (not in the sandbox), so the EC2
    // instance role is the calling principal. The `us.` cross-region inference
    // profile fans out to us-east-1 / us-east-2 / us-west-2, and Bedrock authorizes
    // InvokeModel against BOTH the inference-profile ARN AND the underlying
    // foundation-model ARN in each routed region — all four resources are required
    // or the call AccessDenies. Scoped to opus-4-8 ONLY (least-privilege): adding a
    // new Bedrock model to SUPPORTED_MODELS means extending this resource list.
    // IAM change — flag for T4 (GPT-4.1 IAM cross-review) / T5 (/sh-security-review).
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "InvokeBedrockClaude",
        actions: ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
        resources: [
          `arn:aws:bedrock:${REGION}:${ACCOUNT}:inference-profile/us.anthropic.claude-opus-4-8`,
          "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-opus-4-8",
          "arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-opus-4-8",
          "arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-opus-4-8",
        ],
      }),
    );

    // Ship application logs to CloudWatch Logs under /open-swe/<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "PutAppLogs",
        actions: [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogStreams",
        ],
        resources: [
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*`,
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*:*`,
        ],
      }),
    );
  }
}