Adam Moussa
77302a1ebb
Authored FILES (not applied to AWS — provisioning gated behind the mandatory
GPT-4.1 IAM cross-review + Adam, design §7 B3) for the aws-posture checker's
read-only AWS identity. Decision D5: box stays read-only, auths via IAM Roles
Anywhere short-lived leaf certs from a new internal step-ca; NO long-lived AWS key.
- aws-posture-readonly-policy.json least-privilege read-only (ce:Get*,
cloudwatch:GetMetric*/DescribeAlarms, ec2/elb/rds:Describe*, lambda list +
GetFunctionConfiguration, s3:ListAllMyBuckets/GetBucketLocation). No write,
no iam:* mutation, no s3:GetObject/secrets/kms/logs data reads, no wildcard
actions. Resource:* only where AWS has no resource-level support.
- aws-posture-readonly-policy.rationale.md per-statement least-privilege rationale.
- aws-posture-trust-policy.json pins Roles Anywhere principal + leaf subject CN +
issuer CN + trust-anchor SourceArn (three conditions, all required).
- roles-anywhere-config.json trust anchor (pins step-ca root) + profile (1h session).
- step-ca-config-sketch.md internal CA config + systemd-timer leaf auto-renewal.
- CROSS-REVIEW-PACKET.md end-to-end trust model, blast radius, EXERCISED rollback,
reviewer scrutiny list.
Does NOT build aws-posture.sh, touch checker_coordinator.sh, or requirements.txt.
1.7 KiB
security-review/iam/ — Phase-3 IAM artifacts (authored for cross-review, NOT applied)
These are the IAM / Roles Anywhere / step-ca artifacts for the R720 agent-team aws-posture
checker (design docs/r720-agent-team-design.md D5 / §4 / §6.3 / §7 Phase 3).
Nothing here is applied to AWS. They are FILES for the mandatory GPT-4.1 IAM cross-review.
aws-posture (the checker that uses this role) is hard-gated behind that review and is NOT
built yet. Provisioning happens only after the review is recorded (design §7, B3) — and a VM
snapshot is taken first per feedback_ec2_replacement_snapshot.
Decision (D5): the box stays read-only and authenticates to AWS via Roles Anywhere short-lived leaf certs issued by a new internal step-ca — no long-lived AWS key on the box.
| File | Purpose |
|---|---|
CROSS-REVIEW-PACKET.md |
Start here. End-to-end trust model, least-privilege rationale, blast radius, exercised rollback, and the specific items for the reviewer. |
aws-posture-readonly-policy.json |
Least-privilege read-only permission policy (valid, applyable IAM JSON). |
aws-posture-readonly-policy.rationale.md |
Statement-by-statement rationale (IAM JSON can't carry comments). |
aws-posture-trust-policy.json |
Role trust policy — pins Roles Anywhere + the leaf subject/issuer CN + trust-anchor ARN. |
roles-anywhere-config.json |
Trust-anchor (pins step-ca root) + profile (1h session) config. |
step-ca-config-sketch.md |
Internal CA config + systemd-timer auto-renewal of the short-lived leaf. |
Per global instructions this IAM change also requires the GPT-4.1 cross-family review via
orchestrator/run.py; this directory is that review's input.