open-swe/infra/lib/constructs/instance-role.ts

import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";
import { ACCOUNT, EnvName, REGION, prefix } from "../config";

/**
 * Least-privilege EC2 instance role for the open-swe box (one per env).
 *
 * Grants exactly what the boot/runtime flow needs and NOTHING ELSE — no admin,
 * no `*` resources except where the AWS action genuinely has no resource-level
 * scoping. Per-env so the dev box can never read prod secrets/config and vice
 * versa. Reviewed at T4 (GPT-4.1 IAM cross-review) / T5 (/sh-security-review)
 * before it is ever deployed (T6).
 */
export class InstanceRole extends Construct {
  public readonly role: iam.Role;

  constructor(scope: Construct, id: string, env: EnvName) {
    super(scope, id);
    const p = prefix(env);

    this.role = new iam.Role(this, "Role", {
      roleName: `${p}-instance-role`,
      assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
      description: `EC2 instance role for the ${p} open-swe box (least-privilege).`,
    });

    // AWS-managed: lets the SSM agent register the instance and RECEIVE the
    // app-deploy `ssm:SendCommand` from githubdeploy-open-swe-app. This is the
    // standard Session-Manager / RunCommand grant and is the only managed
    // policy on the role. DELIBERATE — flag for T4 confirmation.
    this.role.addManagedPolicy(
      iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore"),
    );

    // Read the build artifact from the env's S3 asset bucket (deploy = pull).
    // Scoped to releases/* — the only prefix CI writes and the box pulls — so a
    // compromised box (or stolen IMDS creds) cannot read anything else that might
    // ever land in the bucket (least-privilege; mirrors the app role's write scope).
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadArtifactObjects",
        actions: ["s3:GetObject"],
        resources: [`arn:aws:s3:::${p}-assets/releases/*`],
      }),
    );
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ListArtifactBucket",
        actions: ["s3:ListBucket", "s3:GetBucketLocation"],
        resources: [`arn:aws:s3:::${p}-assets`],
      }),
    );

    // Read non-sensitive config from SSM Parameter Store under /open-swe-<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSsmConfig",
        actions: ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
        resources: [`arn:aws:ssm:${REGION}:${ACCOUNT}:parameter/${p}/*`],
      }),
    );

    // VALUE access — Secrets Manager under open-swe-<env>/*. Secret ARNs carry a
    // random 6-char suffix, hence the trailing `*`. This is the statement that
    // actually gates which secret VALUES the box can read: prefix-scoped, so the
    // dev box can never read prod secret values (and vice versa). GetSecretValue is
    // checked per-secret even when the value is returned via BatchGetSecretValue.
    //
    // BatchGetSecretValue is included here (prefix-scoped, NOT `*`) because
    // fetch-config.sh now fetches by EXPLICIT `--secret-id-list` rather than a name
    // `--filters` scan (OSWE-IAC-SECRETS-LIST-01). An id-list batch call authorizes
    // against each referenced secret's ARN, so the prefix ARN satisfies it — and we
    // no longer need the account-wide `secretsmanager:ListSecrets` grant that a
    // filtered collection scan unavoidably forced (ListSecrets has no resource-level
    // scoping). Net effect: the box can read open-swe-<env>/* secret values and
    // nothing else — it can no longer enumerate secret names account-wide.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "ReadSecretValues",
        actions: [
          "secretsmanager:GetSecretValue",
          "secretsmanager:BatchGetSecretValue",
          "secretsmanager:DescribeSecret",
        ],
        resources: [`arn:aws:secretsmanager:${REGION}:${ACCOUNT}:secret:${p}/*`],
      }),
    );

    // NOTE (T11): SSM SecureString + Secrets Manager here are assumed to use the
    // AWS-managed keys (alias/aws/ssm, alias/aws/secretsmanager) for which the
    // service grants Decrypt implicitly — so NO kms:Decrypt is granted. If T11
    // moves these to a customer CMK, add a scoped `kms:Decrypt` on that key ARN
    // ONLY (not `*`).

    // Ship application logs to CloudWatch Logs under /open-swe/<env>/*.
    this.role.addToPolicy(
      new iam.PolicyStatement({
        sid: "PutAppLogs",
        actions: [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "logs:DescribeLogStreams",
        ],
        resources: [
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*`,
          `arn:aws:logs:${REGION}:${ACCOUNT}:log-group:/open-swe/${env}/*:*`,
        ],
      }),
    );
  }
}