Adam Moussa cdcb6625b9 fix: BatchGetSecretValue must be on * for the filtered batch call (#23) ... The prior fix scoped secretsmanager:BatchGetSecretValue to the env-prefixed secret ARN, but the live box still got AccessDenied: batch-get-secret-value invoked WITH a name --filters is a COLLECTION call that AWS authorizes against * (a per-secret ARN does not satisfy it). Split the statement: - GetSecretValue + DescribeSecret stay PREFIX-scoped (secret:open-swe-<env>/*) — this is what gates which secret VALUES the box can read (checked per-secret in the batch). - BatchGetSecretValue + ListSecrets move to a * operation-level statement (the filtered collection call + the list action; neither is resource-scopable for this usage). VALUE isolation preserved (dev box still cannot read prod secret values); only secret NAME/metadata enumeration is widened. GPT-4.1 IAM cross-review: BLOCK none, FIX none. Suppression OSWE-IAC-SECRETS-LIST-01 updated; future hardening (explicit --secret-id-list to drop both * grants) tracked there.		2026-06-26 19:44:12 -04:00
..
aspects	feat: Secrets Manager + SSM config store for open-swe (T11) (#10)	2026-06-26 16:07:23 -04:00
constructs	fix: BatchGetSecretValue must be on * for the filtered batch call (#23)	2026-06-26 19:44:12 -04:00
config.ts	feat(infra): add /infra CDK scaffold + per-env OIDC/instance IAM role defs (#6)	2026-06-26 15:06:30 -04:00
open-swe-iam-stack.ts	feat(infra): add /infra CDK scaffold + per-env OIDC/instance IAM role defs (#6)	2026-06-26 15:06:30 -04:00
open-swe-stack.ts	feat: stand up dev properly — assets bucket + artifact CD + baked AMI + on-box uv sync (T7+T19+T14) (#18)	2026-06-26 18:49:09 -04:00