orchestrator/security-review/iam/CROSS-REVIEW-PACKET.md

# Cross-review packet — R720 aws-posture IAM (step-ca → Roles Anywhere → read-only AWS role)

> **GPT-4.1 cross-review 2026-06-18: APPROVE, no BLOCKs; FIXes applied**
> (`aws:SourceAccount` added to the trust policy; `ec2:DescribeImages` removed from the
> permission policy). NIT answers recorded in `aws-posture-readonly-policy.rationale.md`:
> snapshots = account-owned idle-spend signal (kept); `s3:ListAllMyBuckets` = names-only
> inventory, no object data (kept); no `logs:*` needed; `aws:RequestedRegion` deliberately
> SKIPPED (global-endpoint `ce:*`/`s3:ListAllMyBuckets` could be DENYed by a blanket region pin).

**Audience:** the mandatory GPT-4.1 IAM cross-review + Adam.
**Status:** these are AUTHORED FILES, nothing is applied to AWS. The review has now PASSED
(APPROVE, no BLOCKs), which unblocks **building** aws-posture (done in this Phase-3 change set,
PROVISIONING-GATED — the checker makes no AWS call until step-ca + Roles Anywhere are stood up).
Approving this packet unblocks provisioning; it does not itself change AWS.

**Account:** 328440206208 · **Region:** us-east-1 · **Box:** the always-on R720 secrev VM
(single-user, unattended, currently holds a long-lived read-only GitHub PAT).

## Why this exists

aws-posture (design D5 / §4) is a weekly idle/anomalous-spend watch (the design flags ≈$330/mo
of waste). It must read Cost Explorer + utilization metrics + an idle-resource inventory from
the account. The decision (D5): **the box stays read-only, and it authenticates to AWS via IAM
Roles Anywhere using short-lived leaf certs issued by a new internal step-ca — NO long-lived
AWS access key on the box.** The short-lived self-expiring leaf is strictly stronger than the
box's existing long-lived PAT.

## Files in this packet

| File | What it is |
|---|---|
| `aws-posture-readonly-policy.json` | The least-privilege **permission policy** (valid IAM JSON, applyable as-is). |
| `aws-posture-readonly-policy.rationale.md` | Statement-by-statement least-privilege rationale (IAM JSON can't hold comments). |
| `aws-posture-trust-policy.json` | The role's **trust policy** — who may assume it (Roles Anywhere + pinned cert CN/issuer + pinned trust-anchor ARN). |
| `roles-anywhere-config.json` | The Roles Anywhere **trust anchor + profile** config (pins the step-ca root; 1h session cap). |
| `step-ca-config-sketch.md` | The internal **CA** config + the systemd-timer **auto-renewal** approach. |
| `CROSS-REVIEW-PACKET.md` | This document. |

## Trust model, end to end

```
step-ca ROOT cert (CN="Sea Haven Internal CA - R720 Roles Anywhere")
  │  pinned as the Roles Anywhere trust anchor (roles-anywhere-config.json)
  ▼
step-ca issues a SHORT-LIVED leaf  (CN="r720-aws-posture", ~24h, auto-renewed hourly by systemd timer)
  │  stored mode-600 on the box; private key never leaves the box; no AWS key on disk
  ▼
box calls AWS via aws_signing_helper credential-process, signing with the leaf
  ▼
IAM Roles Anywhere trust anchor  (r720-aws-posture-step-ca)
  │  validates: leaf chains to the pinned root? yes -> emit session tags
  │             aws:PrincipalTag/x509Subject/CN = "r720-aws-posture"
  │             aws:PrincipalTag/x509Issuer/CN  = "Sea Haven Internal CA - R720 Roles Anywhere"
  ▼
Roles Anywhere profile  (r720-aws-posture-readonly, durationSeconds=3600)
  │  binds ONLY the one role
  ▼
sts:AssumeRole on  role/r720-aws-posture-readonly
  │  trust policy (aws-posture-trust-policy.json) requires ALL of:
  │    (1) Principal = rolesanywhere.amazonaws.com   (came via Roles Anywhere)
  │    (2) aws:SourceArn = THIS trust anchor          (not some other anchor)
  │    (2b) aws:SourceAccount = 328440206208          (confused-deputy guard, added in cross-review)
  │    (3) x509Subject/CN = "r720-aws-posture" AND x509Issuer/CN = the internal CA
  ▼
1-hour STS session, permissions = aws-posture-readonly-policy.json (read-only cost + idle inventory)
  ▼
read-only AWS APIs: ce:Get*, cloudwatch:GetMetric*/DescribeAlarms, ec2/elb/rds:Describe*,
                    lambda:List/GetFunctionConfiguration, s3:ListAllMyBuckets/GetBucketLocation
```

Three independent conditions must ALL hold to assume the role: via Roles Anywhere, from THIS
anchor (in THIS account, via the `aws:SourceAccount` guard added in cross-review), presenting a
leaf with the pinned subject CN + issuer CN. Any one missing → AssumeRole denied.

## Least-privilege rationale (summary; full table in the rationale .md)

- **Read-only only.** No write/modify/delete verb in any service. No `iam:*` mutation, no
  privilege-escalation path, no `sts` onward-chaining.
- **`Resource: "*"` only where AWS gives no choice.** Cost Explorer, the CloudWatch metric-data
  calls, and the EC2/ELB/RDS `Describe*` list operations do not support resource-level ARNs;
  least-privilege there is the **action allow-list**, not the resource. There are no wildcard
  *actions* (`ce:*`, `ec2:*`) anywhere — every action is an explicit read verb.
- **No data-plane reads.** Deliberately excludes `s3:GetObject`, `secretsmanager:GetSecretValue`,
  `ssm:GetParameter*`, `kms:Decrypt`, `logs:GetLogEvents`. The role enumerates and prices the
  account; it cannot read application data, secrets, or logs.
- **Tighter than the AWS-managed `ReadOnlyAccess`/`ViewOnlyAccess`** (those include object reads,
  table reads, etc.) — this is the small cost+inventory subset aws-posture actually queries.

## Blast radius if the leaf (or its private key) is compromised

- **Ceiling = read-only enumeration + pricing of account 328440206208 for ≤1 hour per session**
  (STS `durationSeconds=3600`), and only while a valid unexpired leaf exists (~24h leaf life).
- **Cannot:** read S3 object data, read secrets/SSM params, read CloudWatch *logs*, modify or
  delete any resource, touch IAM, assume any other role, or act in any other account/region
  scope beyond what read-only describe calls expose.
- **Containment levers, fastest first:**
  1. **Disable the Roles Anywhere profile or trust anchor** (`enabled:false`) → immediately stops
     all new credential vending, regardless of leaf validity. (seconds)
  2. **Detach/empty the role's permission policy** → any still-live session loses all access at
     the next AWS authz check. (seconds)
  3. **Revoke at the CA / rotate the leaf** → step-ca stops renewing; the leaf self-expires within
     its ≤24h window even with no action.
- The self-expiring leaf means even a "do nothing" outcome bounds exposure to the leaf lifetime —
  unlike the box's current long-lived PAT, which would persist until manually rotated.

## Rollback (EXERCISED, not just written — design §7 "exercised, not merely written")

Teardown order is the reverse of provisioning; each step is independently sufficient to cut
access. Tested via a simulated teardown/re-provision against throwaway names (see "Exercise"
below) before this packet is accepted.

```bash
ACC=328440206208 ; REG=us-east-1
TA_ID=REPLACE_TRUST_ANCHOR_ID ; PROF_ID=REPLACE_PROFILE_ID
ROLE=r720-aws-posture-readonly ; POLICY=r720-aws-posture-readonly

# 1) Stop credential vending FIRST (fastest cut): disable then delete the profile + trust anchor.
aws rolesanywhere disable-profile      --profile-id "$PROF_ID" --region "$REG"
aws rolesanywhere disable-trust-anchor --trust-anchor-id "$TA_ID" --region "$REG"
aws rolesanywhere delete-profile       --profile-id "$PROF_ID" --region "$REG"
aws rolesanywhere delete-trust-anchor  --trust-anchor-id "$TA_ID" --region "$REG"

# 2) Remove the role + its permission policy.
POLICY_ARN="arn:aws:iam::$ACC:policy/$POLICY"
aws iam detach-role-policy --role-name "$ROLE" --policy-arn "$POLICY_ARN"
aws iam delete-role        --role-name "$ROLE"
aws iam delete-policy      --policy-arn "$POLICY_ARN"

# 3) Remove the internal CA + the leaf on the box (no AWS state involved).
sudo systemctl disable --now aws-posture-cert-renew.timer step-ca.service
sudo rm -f /etc/aws-posture/leaf.crt /etc/aws-posture/leaf.key
sudo rm -rf /etc/step-ca           # destroys root/intermediate/keys -> no further leaves issuable
# (optional) remove the [profile r720-aws-posture] block from ~/.aws/config
```

**Re-provision** = re-run `step ca init` (step-ca-config-sketch.md) → re-create role + policy +
trust anchor + profile → drop in the new trust-anchor/profile ARNs. A revert point (VM snapshot
per `feedback_ec2_replacement_snapshot`) is taken before provisioning so the whole change is one
snapshot-restore away from gone.

### Exercise log (to be completed before acceptance)

> Run the provision → assume-once (confirm read-only works, confirm a write is denied) → run the
> rollback above against throwaway-suffixed names → confirm AssumeRole now fails and the CA is
> gone. Paste the transcript here. Until this is filled in, the rollback is "written, not
> exercised" and the phase is NOT accepted (design §7).

## Specific things for the cross-reviewer to scrutinize (with resolutions)

1. **Trust-policy condition completeness.** Are `aws:PrincipalTag/x509Subject/CN` +
   `aws:PrincipalTag/x509Issuer/CN` + `ArnEquals aws:SourceArn` (the trust anchor) sufficient
   to prevent any other cert (or another trust anchor in the account) from assuming the role?
   Is there a confused-deputy gap I should also pin (e.g. should I add `aws:SourceAccount`)?
   → **RESOLVED (FIX applied):** added `aws:SourceAccount = 328440206208` to the StringEquals
   condition. The trust now pins anchor (SourceArn) **and** account (SourceAccount) plus the
   cert CN/issuer — closing the confused-deputy gap the reviewer raised.
2. **`Resource: "*"` statements.** Confirm each is an API that genuinely has no resource-level
   support, and that no statement could be tightened with a condition (e.g. `aws:RequestedRegion`
   = us-east-1) without breaking the checker.
   → **RESOLVED (NIT, SKIPPED with rationale):** every `Resource:"*"` statement is an
   API family without resource-level ARNs (ce, the cloudwatch metric-data calls, ec2/elb/rds
   `Describe*`). `aws:RequestedRegion` is **NOT** applied — `ce:*` and `s3:ListAllMyBuckets` are
   global-endpoint services that a blanket region condition could DENY. Full reasoning in
   `aws-posture-readonly-policy.rationale.md` ("Cross-review NIT answers").
3. **Action allow-list.** Anything in here that is NOT needed for idle/anomalous-spend (i.e.
   over-grant), or any read verb that leaks data we don't want (the intent is pricing + inventory,
   no object/secret/log data).
   → **RESOLVED (FIX applied):** removed `ec2:DescribeImages` (AMIs are not an idle-spend signal).
   `ec2:DescribeSnapshots` kept (orphan-snapshot waste, account-owned metadata only);
   `s3:ListAllMyBuckets` kept (bucket *names* only, no `s3:GetObject`); no `logs:*` granted.
4. **Session duration vs leaf lifetime.** 1h STS session + ~24h leaf — acceptable blast window?
   → Accepted as-is (no change requested).
5. **Rollback ordering.** Is disabling the profile/anchor first the correct fastest-cut order,
   and does step 2/3 leave any orphaned grant?
   → Accepted as-is (no change requested).

## Process note

Per global instructions this IAM change ALSO requires the GPT-4.1 cross-family review run via
`python3 ~/Documents/repositories/orchestrator/run.py "<diff/describe>"` (it is an IAM
role/policy + trust-anchor change). This packet is the input to that review; aws-posture is not
built until the review is recorded.