mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-10-06 19:11:57 +00:00
chore(iam): remove parked githubdeploy-procurement-ingest artifacts (#170)
This commit is contained in:
Adam Moussa
GitHub
parent
752de7f6dd
commit
19046711b4
6 changed files with 2 additions and 182 deletions
|
|
@ -351,7 +351,7 @@ Branch protection on `main` — all changes through PR.
|
||||||
aws lambda invoke --function-name po-web-ui --payload "{\"headers\":{\"x-auth-token\":\"$TOKEN\"}}" /tmp/out.json
|
aws lambda invoke --function-name po-web-ui --payload "{\"headers\":{\"x-auth-token\":\"$TOKEN\"}}" /tmp/out.json
|
||||||
```
|
```
|
||||||
|
|
||||||
> **Parked:** `githubdeploy-procurement-ingest` (see `infra/deploy-role/`) is unused after the HCP hard-cut. Left in place for a separate IAM-reviewed cleanup. Do not recreate a mgmt twin (deleted in PLAT-67).
|
> **Removed (PLAT-88):** `githubdeploy-procurement-ingest` OIDC deploy role and `infra/deploy-role/` artifacts deleted after the HCP hard-cut. Do not recreate a mgmt twin (deleted in PLAT-67).
|
||||||
|
|
||||||
## Tests
|
## Tests
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -18,7 +18,7 @@ Never run `cfn-stack-decommission.sh --execute` against these stacks. That scrip
|
||||||
2. **Delete stack** — `delete-stack` after `UPDATE_COMPLETE`. All resources leave CFN without destruction.
|
2. **Delete stack** — `delete-stack` after `UPDATE_COMPLETE`. All resources leave CFN without destruction.
|
||||||
3. **Verify immediately** — `GetBucketNotificationConfiguration` still lists inbound Lambda triggers; SES receipt rules for PO/WO still present on `INBOUND_MAIL`; named Lambdas/tables/buckets still exist; smoke script green.
|
3. **Verify immediately** — `GetBucketNotificationConfiguration` still lists inbound Lambda triggers; SES receipt rules for PO/WO still present on `INBOUND_MAIL`; named Lambdas/tables/buckets still exist; smoke script green.
|
||||||
4. **Sweep CDK helpers only** — delete orphaned `*BucketNotificationsHandler*` Lambda functions and their IAM roles/policies (both stacks). Do not delete TF-owned Lambdas, tables, buckets, API GW, SES rules, or SHOC secret/KMS.
|
4. **Sweep CDK helpers only** — delete orphaned `*BucketNotificationsHandler*` Lambda functions and their IAM roles/policies (both stacks). Do not delete TF-owned Lambdas, tables, buckets, API GW, SES rules, or SHOC secret/KMS.
|
||||||
5. **Park** `githubdeploy-procurement-ingest` for a separate IAM-reviewed cleanup (do not block dispose).
|
5. **Park** `githubdeploy-procurement-ingest` for a separate IAM-reviewed cleanup (do not block dispose). **Done (PLAT-88):** role and `infra/deploy-role/` removed.
|
||||||
|
|
||||||
## Script
|
## Script
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
# Deploy role: githubdeploy-procurement-ingest (seahaven-prod) — PARKED
|
|
||||||
|
|
||||||
> **PLAT-86 (2026-08-07):** CDK CD is retired. HCP Terraform workspace
|
|
||||||
> `procurement-ingest-prod` is the sole mutate path. This OIDC role is an
|
|
||||||
> **unused orphan** retained for a separate IAM-reviewed cleanup (same pattern
|
|
||||||
> as afi-backup-monitor / front-integrations). Do not use it for deploys. Do
|
|
||||||
> not recreate a mgmt twin (deleted in PLAT-67).
|
|
||||||
|
|
||||||
OIDC deploy role historically used by this repo's GitHub Actions CDK pipeline in
|
|
||||||
AWS account `011934824531` (seahaven-prod), us-east-1.
|
|
||||||
|
|
||||||
## Files
|
|
||||||
|
|
||||||
| File | Purpose |
|
|
||||||
|---|---|
|
|
||||||
| `trust-policy.json` | OIDC trust: `repo:Sea-Haven-Industries/procurement-ingest:ref:refs/heads/main` only |
|
|
||||||
| `permissions-policy.json` | Historical CDK bootstrap AssumeRole + smoke InvokeFunction grants |
|
|
||||||
| `create-deploy-role.sh` | Idempotent create-or-update (do not run unless deliberately restoring) |
|
|
||||||
|
|
||||||
## Retirement follow-up
|
|
||||||
|
|
||||||
1. Confirm no workflow references `AWS_DEPLOY_ROLE_ARN` / `cd-cdk.yaml`.
|
|
||||||
2. IAM + security review, then delete the role and drop related substrate entries.
|
|
||||||
3. Remove this directory in the same cleanup PR.
|
|
||||||
|
|
@ -1,96 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
###############################################################################
|
|
||||||
# create-deploy-role.sh
|
|
||||||
#
|
|
||||||
# Creates / updates the GitHub Actions OIDC deploy role
|
|
||||||
# `githubdeploy-procurement-ingest` in AWS account 011934824531 (seahaven-prod),
|
|
||||||
# us-east-1, for the Sea-Haven-Industries/procurement-ingest repo (main branch).
|
|
||||||
#
|
|
||||||
# Prod-only deploy role (seahaven-prod). The former mgmt twin was deleted in
|
|
||||||
# PLAT-67 (2026-08-05); do not recreate a mgmt githubdeploy-procurement-ingest.
|
|
||||||
#
|
|
||||||
# GATE - DO NOT EXECUTE until BOTH of the following have passed on these
|
|
||||||
# exact artifact files:
|
|
||||||
# 1. GPT-4.1 cross-family review (IAM policy / trust-policy change) via
|
|
||||||
# cross_review.py in the security-review repo.
|
|
||||||
# 2. /sh-security-review (deep agentic pass - IaC/IAM is a gated surface).
|
|
||||||
#
|
|
||||||
# The SmokeInvokeLambda statement is REQUIRED, not optional: deploy.yaml runs
|
|
||||||
# scripts/post-deploy-smoke.sh under this role's session (not the assumed
|
|
||||||
# cdk-* roles), and the smoke gate fails closed without lambda:InvokeFunction
|
|
||||||
# on exactly the two email-processor function ARNs. The mgmt-era equivalent
|
|
||||||
# of this policy was applied out-of-band and documented nowhere; these
|
|
||||||
# artifacts are the fix for that debt.
|
|
||||||
#
|
|
||||||
# Resolved facts (verified 2026-07-23, read-only):
|
|
||||||
# Account : 011934824531 (seahaven-prod)
|
|
||||||
# Region : us-east-1
|
|
||||||
# Qualifier : hnb659fds (AWS CDK DEFAULT - matches cdk/cdk.json)
|
|
||||||
# OIDC prov : arn:aws:iam::011934824531:oidc-provider/token.actions.githubusercontent.com
|
|
||||||
###############################################################################
|
|
||||||
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
PROFILE="seahaven-prod"
|
|
||||||
ROLE_NAME="githubdeploy-procurement-ingest"
|
|
||||||
POLICY_NAME="procurement-ingest-deploy"
|
|
||||||
ACCOUNT_ID="011934824531"
|
|
||||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
||||||
TRUST_POLICY="file://${SCRIPT_DIR}/trust-policy.json"
|
|
||||||
PERMS_POLICY="file://${SCRIPT_DIR}/permissions-policy.json"
|
|
||||||
|
|
||||||
echo "==> Verifying active account for profile '${PROFILE}'..."
|
|
||||||
CALLER_ACCOUNT="$(aws --profile "${PROFILE}" sts get-caller-identity --query Account --output text)"
|
|
||||||
if [[ "${CALLER_ACCOUNT}" != "${ACCOUNT_ID}" ]]; then
|
|
||||||
echo "ERROR: profile '${PROFILE}' resolves to account ${CALLER_ACCOUNT}, expected ${ACCOUNT_ID}. Aborting." >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "==> Ensuring role '${ROLE_NAME}' exists with the correct trust policy..."
|
|
||||||
if aws --profile "${PROFILE}" iam get-role --role-name "${ROLE_NAME}" >/dev/null 2>&1; then
|
|
||||||
echo " Role exists - updating assume-role (trust) policy."
|
|
||||||
aws --profile "${PROFILE}" iam update-assume-role-policy \
|
|
||||||
--role-name "${ROLE_NAME}" \
|
|
||||||
--policy-document "${TRUST_POLICY}"
|
|
||||||
else
|
|
||||||
echo " Role absent - creating."
|
|
||||||
aws --profile "${PROFILE}" iam create-role \
|
|
||||||
--role-name "${ROLE_NAME}" \
|
|
||||||
--assume-role-policy-document "${TRUST_POLICY}" \
|
|
||||||
--description "GitHub Actions OIDC deploy role for Sea-Haven-Industries/procurement-ingest (main)" \
|
|
||||||
--max-session-duration 3600 \
|
|
||||||
--tags Key=project,Value=procurement-ingest Key=managed-by,Value=create-deploy-role.sh
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "==> Putting inline permissions policy '${POLICY_NAME}' (create-or-replace)..."
|
|
||||||
aws --profile "${PROFILE}" iam put-role-policy \
|
|
||||||
--role-name "${ROLE_NAME}" \
|
|
||||||
--policy-name "${POLICY_NAME}" \
|
|
||||||
--policy-document "${PERMS_POLICY}"
|
|
||||||
|
|
||||||
# Drift check: this script only reconciles the single inline policy above, so
|
|
||||||
# any OTHER inline or attached policy on the role is an unreviewed grant that
|
|
||||||
# diverges the live role from these artifacts. Warn-only (never auto-delete) is
|
|
||||||
# deliberate: this is a shared prod-tenant account and an extra policy might be
|
|
||||||
# a legitimate out-of-band grant an operator must adjudicate, not blindly strip.
|
|
||||||
echo "==> Checking for unexpected policies on the role..."
|
|
||||||
EXTRA_INLINE="$(aws --profile "${PROFILE}" iam list-role-policies \
|
|
||||||
--role-name "${ROLE_NAME}" --query "PolicyNames[?@!='${POLICY_NAME}']" --output text)"
|
|
||||||
EXTRA_ATTACHED="$(aws --profile "${PROFILE}" iam list-attached-role-policies \
|
|
||||||
--role-name "${ROLE_NAME}" --query 'AttachedPolicies[].PolicyName' --output text)"
|
|
||||||
if [[ -n "${EXTRA_INLINE}" || -n "${EXTRA_ATTACHED}" ]]; then
|
|
||||||
echo " WARNING: unreviewed policies present on ${ROLE_NAME} (not in these artifacts):" >&2
|
|
||||||
[[ -n "${EXTRA_INLINE}" ]] && echo " inline: ${EXTRA_INLINE}" >&2
|
|
||||||
[[ -n "${EXTRA_ATTACHED}" ]] && echo " attached: ${EXTRA_ATTACHED}" >&2
|
|
||||||
echo " Review and remove them (delete-role-policy / detach-role-policy) if unexpected." >&2
|
|
||||||
else
|
|
||||||
echo " OK - only ${POLICY_NAME} present."
|
|
||||||
fi
|
|
||||||
|
|
||||||
ROLE_ARN="$(aws --profile "${PROFILE}" iam get-role --role-name "${ROLE_NAME}" \
|
|
||||||
--query Role.Arn --output text)"
|
|
||||||
|
|
||||||
echo "==> Done. Deploy role ready:"
|
|
||||||
echo " ${ROLE_ARN}"
|
|
||||||
echo " Set the GitHub repo secret AWS_DEPLOY_ROLE_ARN to this ARN (Phase 1 merge sequencing:"
|
|
||||||
echo " flip the secret only when Phase 0 is complete and the migration PR is about to merge)."
|
|
||||||
|
|
@ -1,42 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Sid": "AssumeCdkBootstrapRoles",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": "sts:AssumeRole",
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:iam::011934824531:role/cdk-hnb659fds-deploy-role-011934824531-us-east-1",
|
|
||||||
"arn:aws:iam::011934824531:role/cdk-hnb659fds-file-publishing-role-011934824531-us-east-1",
|
|
||||||
"arn:aws:iam::011934824531:role/cdk-hnb659fds-lookup-role-011934824531-us-east-1",
|
|
||||||
"arn:aws:iam::011934824531:role/cdk-hnb659fds-image-publishing-role-011934824531-us-east-1"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "CdkDeployHealthCheck",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": "cloudformation:DescribeStacks",
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:cloudformation:us-east-1:011934824531:stack/po-ingest/*",
|
|
||||||
"arn:aws:cloudformation:us-east-1:011934824531:stack/WorkorderIngestStack/*",
|
|
||||||
"arn:aws:cloudformation:us-east-1:011934824531:stack/procurement-api/*",
|
|
||||||
"arn:aws:cloudformation:us-east-1:011934824531:stack/CDKToolkit/*"
|
|
||||||
],
|
|
||||||
"Condition": {
|
|
||||||
"StringEquals": {
|
|
||||||
"aws:RequestedRegion": "us-east-1"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "SmokeInvokeLambda",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": "lambda:InvokeFunction",
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:lambda:us-east-1:011934824531:function:po-email-processor",
|
|
||||||
"arn:aws:lambda:us-east-1:011934824531:function:workorder-email-processor",
|
|
||||||
"arn:aws:lambda:us-east-1:011934824531:function:procurement-api"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Principal": {
|
|
||||||
"Federated": "arn:aws:iam::011934824531:oidc-provider/token.actions.githubusercontent.com"
|
|
||||||
},
|
|
||||||
"Action": "sts:AssumeRoleWithWebIdentity",
|
|
||||||
"Condition": {
|
|
||||||
"StringEquals": {
|
|
||||||
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
|
|
||||||
"token.actions.githubusercontent.com:sub": "repo:Sea-Haven-Industries/procurement-ingest:ref:refs/heads/main"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
Loading…
Add table
Reference in a new issue