adam/open-swe
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/open-swe.git synced 2026-10-07 16:19:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
open-swe/infra/lib/constructs
History
Adam Moussa 789c59cfdf
fix: scope s3:ListBucket to the releases/ prefix (F-1/IAC-04) 
The instance role and the GitHub deploy app role granted s3:ListBucket on the
whole assets bucket. Every caller (deploy.sh, the publish/rollback scripts)
only ever lists under releases/, so add a StringLike s3:prefix=releases/*
condition. GetBucketLocation has no s3:prefix in its request context, so it
moves to its own unconditioned statement. Also document the accepted F-2
cross-env existence-oracle residual on BatchGetSecretValue.
2026-06-29 11:37:32 -04:00
..
ami-cache.ts feat: stand up dev properly — assets bucket + artifact CD + baked AMI + on-box uv sync (T7+T19+T14) (#18) 2026-06-26 18:49:09 -04:00
app-service.ts fix: env-scope the EC2 launch template name (unblocks prod deploy) (#51) 2026-06-29 00:51:16 -04:00
assets-bucket.ts feat: stand up dev properly — assets bucket + artifact CD + baked AMI + on-box uv sync (T7+T19+T14) (#18) 2026-06-26 18:49:09 -04:00
config-store.ts docs: document RETAIN secret-shell orphan gotcha (#52) 2026-06-29 10:51:49 -04:00
github-deploy-roles.ts fix: scope s3:ListBucket to the releases/ prefix (F-1/IAC-04) 2026-06-29 11:37:32 -04:00
instance-role.ts fix: scope s3:ListBucket to the releases/ prefix (F-1/IAC-04) 2026-06-29 11:37:32 -04:00