From 19046711b4424fe74e7a1452d0ea84017b47f68f Mon Sep 17 00:00:00 2001 From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com> Date: Fri, 7 Aug 2026 12:43:43 -0400 Subject: [PATCH] chore(iam): remove parked githubdeploy-procurement-ingest artifacts (#170) --- README.md | 2 +- docs/plat-86/cfn-dispose.md | 2 +- infra/deploy-role/README.md | 24 ------ infra/deploy-role/create-deploy-role.sh | 96 ----------------------- infra/deploy-role/permissions-policy.json | 42 ---------- infra/deploy-role/trust-policy.json | 18 ----- 6 files changed, 2 insertions(+), 182 deletions(-) delete mode 100644 infra/deploy-role/README.md delete mode 100755 infra/deploy-role/create-deploy-role.sh delete mode 100644 infra/deploy-role/permissions-policy.json delete mode 100644 infra/deploy-role/trust-policy.json diff --git a/README.md b/README.md index 6967c4c..8225ea7 100644 --- a/README.md +++ b/README.md @@ -351,7 +351,7 @@ Branch protection on `main` — all changes through PR. aws lambda invoke --function-name po-web-ui --payload "{\"headers\":{\"x-auth-token\":\"$TOKEN\"}}" /tmp/out.json ``` -> **Parked:** `githubdeploy-procurement-ingest` (see `infra/deploy-role/`) is unused after the HCP hard-cut. Left in place for a separate IAM-reviewed cleanup. Do not recreate a mgmt twin (deleted in PLAT-67). +> **Removed (PLAT-88):** `githubdeploy-procurement-ingest` OIDC deploy role and `infra/deploy-role/` artifacts deleted after the HCP hard-cut. Do not recreate a mgmt twin (deleted in PLAT-67). ## Tests diff --git a/docs/plat-86/cfn-dispose.md b/docs/plat-86/cfn-dispose.md index 7464b9d..41bb97e 100644 --- a/docs/plat-86/cfn-dispose.md +++ b/docs/plat-86/cfn-dispose.md @@ -18,7 +18,7 @@ Never run `cfn-stack-decommission.sh --execute` against these stacks. That scrip 2. **Delete stack** — `delete-stack` after `UPDATE_COMPLETE`. All resources leave CFN without destruction. 3. **Verify immediately** — `GetBucketNotificationConfiguration` still lists inbound Lambda triggers; SES receipt rules for PO/WO still present on `INBOUND_MAIL`; named Lambdas/tables/buckets still exist; smoke script green. 4. **Sweep CDK helpers only** — delete orphaned `*BucketNotificationsHandler*` Lambda functions and their IAM roles/policies (both stacks). Do not delete TF-owned Lambdas, tables, buckets, API GW, SES rules, or SHOC secret/KMS. -5. **Park** `githubdeploy-procurement-ingest` for a separate IAM-reviewed cleanup (do not block dispose). +5. **Park** `githubdeploy-procurement-ingest` for a separate IAM-reviewed cleanup (do not block dispose). **Done (PLAT-88):** role and `infra/deploy-role/` removed. ## Script diff --git a/infra/deploy-role/README.md b/infra/deploy-role/README.md deleted file mode 100644 index e51f744..0000000 --- a/infra/deploy-role/README.md +++ /dev/null @@ -1,24 +0,0 @@ -# Deploy role: githubdeploy-procurement-ingest (seahaven-prod) — PARKED - -> **PLAT-86 (2026-08-07):** CDK CD is retired. HCP Terraform workspace -> `procurement-ingest-prod` is the sole mutate path. This OIDC role is an -> **unused orphan** retained for a separate IAM-reviewed cleanup (same pattern -> as afi-backup-monitor / front-integrations). Do not use it for deploys. Do -> not recreate a mgmt twin (deleted in PLAT-67). - -OIDC deploy role historically used by this repo's GitHub Actions CDK pipeline in -AWS account `011934824531` (seahaven-prod), us-east-1. - -## Files - -| File | Purpose | -|---|---| -| `trust-policy.json` | OIDC trust: `repo:Sea-Haven-Industries/procurement-ingest:ref:refs/heads/main` only | -| `permissions-policy.json` | Historical CDK bootstrap AssumeRole + smoke InvokeFunction grants | -| `create-deploy-role.sh` | Idempotent create-or-update (do not run unless deliberately restoring) | - -## Retirement follow-up - -1. Confirm no workflow references `AWS_DEPLOY_ROLE_ARN` / `cd-cdk.yaml`. -2. IAM + security review, then delete the role and drop related substrate entries. -3. Remove this directory in the same cleanup PR. diff --git a/infra/deploy-role/create-deploy-role.sh b/infra/deploy-role/create-deploy-role.sh deleted file mode 100755 index c251b3b..0000000 --- a/infra/deploy-role/create-deploy-role.sh +++ /dev/null @@ -1,96 +0,0 @@ -#!/usr/bin/env bash -############################################################################### -# create-deploy-role.sh -# -# Creates / updates the GitHub Actions OIDC deploy role -# `githubdeploy-procurement-ingest` in AWS account 011934824531 (seahaven-prod), -# us-east-1, for the Sea-Haven-Industries/procurement-ingest repo (main branch). -# -# Prod-only deploy role (seahaven-prod). The former mgmt twin was deleted in -# PLAT-67 (2026-08-05); do not recreate a mgmt githubdeploy-procurement-ingest. -# -# GATE - DO NOT EXECUTE until BOTH of the following have passed on these -# exact artifact files: -# 1. GPT-4.1 cross-family review (IAM policy / trust-policy change) via -# cross_review.py in the security-review repo. -# 2. /sh-security-review (deep agentic pass - IaC/IAM is a gated surface). -# -# The SmokeInvokeLambda statement is REQUIRED, not optional: deploy.yaml runs -# scripts/post-deploy-smoke.sh under this role's session (not the assumed -# cdk-* roles), and the smoke gate fails closed without lambda:InvokeFunction -# on exactly the two email-processor function ARNs. The mgmt-era equivalent -# of this policy was applied out-of-band and documented nowhere; these -# artifacts are the fix for that debt. -# -# Resolved facts (verified 2026-07-23, read-only): -# Account : 011934824531 (seahaven-prod) -# Region : us-east-1 -# Qualifier : hnb659fds (AWS CDK DEFAULT - matches cdk/cdk.json) -# OIDC prov : arn:aws:iam::011934824531:oidc-provider/token.actions.githubusercontent.com -############################################################################### - -set -euo pipefail - -PROFILE="seahaven-prod" -ROLE_NAME="githubdeploy-procurement-ingest" -POLICY_NAME="procurement-ingest-deploy" -ACCOUNT_ID="011934824531" -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -TRUST_POLICY="file://${SCRIPT_DIR}/trust-policy.json" -PERMS_POLICY="file://${SCRIPT_DIR}/permissions-policy.json" - -echo "==> Verifying active account for profile '${PROFILE}'..." -CALLER_ACCOUNT="$(aws --profile "${PROFILE}" sts get-caller-identity --query Account --output text)" -if [[ "${CALLER_ACCOUNT}" != "${ACCOUNT_ID}" ]]; then - echo "ERROR: profile '${PROFILE}' resolves to account ${CALLER_ACCOUNT}, expected ${ACCOUNT_ID}. Aborting." >&2 - exit 1 -fi - -echo "==> Ensuring role '${ROLE_NAME}' exists with the correct trust policy..." -if aws --profile "${PROFILE}" iam get-role --role-name "${ROLE_NAME}" >/dev/null 2>&1; then - echo " Role exists - updating assume-role (trust) policy." - aws --profile "${PROFILE}" iam update-assume-role-policy \ - --role-name "${ROLE_NAME}" \ - --policy-document "${TRUST_POLICY}" -else - echo " Role absent - creating." - aws --profile "${PROFILE}" iam create-role \ - --role-name "${ROLE_NAME}" \ - --assume-role-policy-document "${TRUST_POLICY}" \ - --description "GitHub Actions OIDC deploy role for Sea-Haven-Industries/procurement-ingest (main)" \ - --max-session-duration 3600 \ - --tags Key=project,Value=procurement-ingest Key=managed-by,Value=create-deploy-role.sh -fi - -echo "==> Putting inline permissions policy '${POLICY_NAME}' (create-or-replace)..." -aws --profile "${PROFILE}" iam put-role-policy \ - --role-name "${ROLE_NAME}" \ - --policy-name "${POLICY_NAME}" \ - --policy-document "${PERMS_POLICY}" - -# Drift check: this script only reconciles the single inline policy above, so -# any OTHER inline or attached policy on the role is an unreviewed grant that -# diverges the live role from these artifacts. Warn-only (never auto-delete) is -# deliberate: this is a shared prod-tenant account and an extra policy might be -# a legitimate out-of-band grant an operator must adjudicate, not blindly strip. -echo "==> Checking for unexpected policies on the role..." -EXTRA_INLINE="$(aws --profile "${PROFILE}" iam list-role-policies \ - --role-name "${ROLE_NAME}" --query "PolicyNames[?@!='${POLICY_NAME}']" --output text)" -EXTRA_ATTACHED="$(aws --profile "${PROFILE}" iam list-attached-role-policies \ - --role-name "${ROLE_NAME}" --query 'AttachedPolicies[].PolicyName' --output text)" -if [[ -n "${EXTRA_INLINE}" || -n "${EXTRA_ATTACHED}" ]]; then - echo " WARNING: unreviewed policies present on ${ROLE_NAME} (not in these artifacts):" >&2 - [[ -n "${EXTRA_INLINE}" ]] && echo " inline: ${EXTRA_INLINE}" >&2 - [[ -n "${EXTRA_ATTACHED}" ]] && echo " attached: ${EXTRA_ATTACHED}" >&2 - echo " Review and remove them (delete-role-policy / detach-role-policy) if unexpected." >&2 -else - echo " OK - only ${POLICY_NAME} present." -fi - -ROLE_ARN="$(aws --profile "${PROFILE}" iam get-role --role-name "${ROLE_NAME}" \ - --query Role.Arn --output text)" - -echo "==> Done. Deploy role ready:" -echo " ${ROLE_ARN}" -echo " Set the GitHub repo secret AWS_DEPLOY_ROLE_ARN to this ARN (Phase 1 merge sequencing:" -echo " flip the secret only when Phase 0 is complete and the migration PR is about to merge)." diff --git a/infra/deploy-role/permissions-policy.json b/infra/deploy-role/permissions-policy.json deleted file mode 100644 index fc7261b..0000000 --- a/infra/deploy-role/permissions-policy.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AssumeCdkBootstrapRoles", - "Effect": "Allow", - "Action": "sts:AssumeRole", - "Resource": [ - "arn:aws:iam::011934824531:role/cdk-hnb659fds-deploy-role-011934824531-us-east-1", - "arn:aws:iam::011934824531:role/cdk-hnb659fds-file-publishing-role-011934824531-us-east-1", - "arn:aws:iam::011934824531:role/cdk-hnb659fds-lookup-role-011934824531-us-east-1", - "arn:aws:iam::011934824531:role/cdk-hnb659fds-image-publishing-role-011934824531-us-east-1" - ] - }, - { - "Sid": "CdkDeployHealthCheck", - "Effect": "Allow", - "Action": "cloudformation:DescribeStacks", - "Resource": [ - "arn:aws:cloudformation:us-east-1:011934824531:stack/po-ingest/*", - "arn:aws:cloudformation:us-east-1:011934824531:stack/WorkorderIngestStack/*", - "arn:aws:cloudformation:us-east-1:011934824531:stack/procurement-api/*", - "arn:aws:cloudformation:us-east-1:011934824531:stack/CDKToolkit/*" - ], - "Condition": { - "StringEquals": { - "aws:RequestedRegion": "us-east-1" - } - } - }, - { - "Sid": "SmokeInvokeLambda", - "Effect": "Allow", - "Action": "lambda:InvokeFunction", - "Resource": [ - "arn:aws:lambda:us-east-1:011934824531:function:po-email-processor", - "arn:aws:lambda:us-east-1:011934824531:function:workorder-email-processor", - "arn:aws:lambda:us-east-1:011934824531:function:procurement-api" - ] - } - ] -} diff --git a/infra/deploy-role/trust-policy.json b/infra/deploy-role/trust-policy.json deleted file mode 100644 index e67a290..0000000 --- a/infra/deploy-role/trust-policy.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Federated": "arn:aws:iam::011934824531:oidc-provider/token.actions.githubusercontent.com" - }, - "Action": "sts:AssumeRoleWithWebIdentity", - "Condition": { - "StringEquals": { - "token.actions.githubusercontent.com:aud": "sts.amazonaws.com", - "token.actions.githubusercontent.com:sub": "repo:Sea-Haven-Industries/procurement-ingest:ref:refs/heads/main" - } - } - } - ] -}