open-swe/infra/lib/constructs/instance-role.ts

import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";
import { ACCOUNT, EnvName, REGION, prefix } from "../config";

/**
 * Least-privilege EC2 instance role for the open-swe box (one per env).
 *
 * Grants exactly what the boot/runtime flow needs and NOTHING ELSE — no admin,
 * no `*` resources except where the AWS action genuinely has no resource-level
 * scoping. Per-env so the dev box can never read prod secrets/config and vice
 * versa. Reviewed at T4 (GPT-4.1 IAM cross-review) / T5 (/sh-security-review)
 * before it is ever deployed (T6).
 */
export class InstanceRole extends Construct {
  public readonly role: iam.Role;

  constructor(scope: Construct, id: string, env: EnvName) {
    super(scope, id);
    const p = prefix(env);

    this.role = new iam.Role(this, "Role", {
      roleName: `${p}-instance-role`,
      assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
      description: `EC2 instance role for the ${p} open-swe box (least-privilege).`,
    });

    // AWS-managed: lets the SSM agent register the instance and RECEIVE the
    // app-deploy `ssm:SendCommand` from githubdeploy-open-swe-app. This is the
    // standard Session-Manager / RunCommand grant and is the only managed
    // policy on the role. DELIBERATE — flag for T4 confirmation.
    this.role.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
    );

    // Read the build artifact from the env's S3 asset bucket (deploy = pull).
    // Scoped to releases/* — the only prefix CI writes and the box pulls — so a
    // compromised box (or stolen IMDS creds) cannot read anything else that might
    // ever land in the bucket (least-privilege; mirrors the app role's write scope).
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadArtifactObjects",
        actions: ["s3:GetObject"],
        resources: [`arn:aws:s3:::${p}-assets/releases/*`],
      }),
    );
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ListArtifactBucket",
        actions: ["s3:ListBucket", "s3:GetBucketLocation"],
        resources: [`arn:aws:s3:::${p}-assets`],
      }),
    );

    // Read non-sensitive config from SSM Parameter Store under /open-swe-<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSsmConfig",
        actions: ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
        resources: [`arn:aws:ssm:${REGION}:${ACCOUNT}:parameter/${p}/*`],
      }),
    );

    // VALUE access — Secrets Manager under open-swe-<env>/*. Secret ARNs carry a
    // random 6-char suffix, hence the trailing `*`. This is the statement that
    // actually gates which secret VALUES the box can read: prefix-scoped, so the
    // dev box can never read prod secret values (and vice versa). GetSecretValue is
    // checked per-secret even when the value is returned via the batch call below.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSecretValues",
        actions: ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"],
        resources: [`arn:aws:secretsmanager:${REGION}:${ACCOUNT}:secret:${p}/*`],
      }),
    );

    // BatchGetSecretValue MUST be granted on `*` — it is a collection action that
    // AWS authorizes against the account, NOT the per-secret ARN, REGARDLESS of
    // whether the caller uses `--filters` or `--secret-id-list`. A prefix-scoped
    // BatchGetSecretValue AccessDenies the whole call ("no identity-based policy
    // allows the secretsmanager:BatchGetSecretValue action") — VERIFIED on the live
    // dev box 2026-06-29 (the OSWE-IAC-SECRETS-LIST-01 attempt to prefix-scope it
    // crash-looped the box once the prior broad grant's eventual-consistency lapsed).
    // This `*` does NOT widen VALUE access: a secret value is only returned when the
    // prefix-scoped GetSecretValue above also allows it, so cross-env value isolation
    // holds. The win that DID survive: fetch-config uses `--secret-id-list` (explicit
    // names, no name filter), so `secretsmanager:ListSecrets` is NOT needed and is
    // intentionally omitted — the box cannot enumerate secret names account-wide.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "BatchGetSecretValues",
        actions: ["secretsmanager:BatchGetSecretValue"],
        resources: ["*"],
      }),
    );

    // NOTE (T11): SSM SecureString + Secrets Manager here are assumed to use the
    // AWS-managed keys (alias/aws/ssm, alias/aws/secretsmanager) for which the
    // service grants Decrypt implicitly — so NO kms:Decrypt is granted. If T11
    // moves these to a customer CMK, add a scoped `kms:Decrypt` on that key ARN
    // ONLY (not `*`).

    // Ship application logs to CloudWatch Logs under /open-swe/<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "PutAppLogs",
        actions: [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogStreams",
        ],
        resources: [
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*`,
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*:*`,
        ],
      }),
    );
  }
}