From 3bbf6247bf21cac75ea48caeb31a8f317c51c18f Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 23 Jul 2026 16:12:23 -0400 Subject: [PATCH] docs(deploy-role): fold in cross-review NITs (DescribeStacks maintenance note, warn-only drift rationale) --- infra/deploy-role/README.md | 4 +++- infra/deploy-role/create-deploy-role.sh | 5 +++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/infra/deploy-role/README.md b/infra/deploy-role/README.md index 089f4c4..5dbfec5 100644 --- a/infra/deploy-role/README.md +++ b/infra/deploy-role/README.md @@ -10,9 +10,11 @@ stays untouched until decommission as the emergency mgmt deploy path. | File | Purpose | |---|---| | `trust-policy.json` | OIDC trust: `repo:Sea-Haven-Industries/procurement-ingest:ref:refs/heads/main` only | -| `permissions-policy.json` | `sts:AssumeRole` on the four `cdk-hnb659fds-*` bootstrap roles, `cloudformation:DescribeStacks` (cd-cdk health check), and `lambda:InvokeFunction` on exactly the two email-processor function ARNs (post-deploy smoke gate) | +| `permissions-policy.json` | `sts:AssumeRole` on the four `cdk-hnb659fds-*` bootstrap roles, `cloudformation:DescribeStacks` scoped to this repo's stacks + `CDKToolkit` (cd-cdk health check), and `lambda:InvokeFunction` on exactly the two email-processor function ARNs (post-deploy smoke gate) | | `create-deploy-role.sh` | Idempotent create-or-update from the two JSON files, profile `seahaven-prod` | +> **Maintenance note:** `DescribeStacks` is scoped to `stack/po-ingest/*`, `stack/WorkorderIngestStack/*`, and `stack/CDKToolkit/*`. If a third stack is ever added to this CDK app, add its ARN pattern here and re-run the review-then-apply flow — otherwise the cd-cdk health check on the new stack will `AccessDenied`. + ## Why the SmokeInvokeLambda statement exists `deploy.yaml` runs `scripts/post-deploy-smoke.sh` under the deploy role's own diff --git a/infra/deploy-role/create-deploy-role.sh b/infra/deploy-role/create-deploy-role.sh index ad02fa5..ee2587b 100755 --- a/infra/deploy-role/create-deploy-role.sh +++ b/infra/deploy-role/create-deploy-role.sh @@ -70,8 +70,9 @@ aws --profile "${PROFILE}" iam put-role-policy \ # Drift check: this script only reconciles the single inline policy above, so # any OTHER inline or attached policy on the role is an unreviewed grant that -# diverges the live role from these artifacts. Warn loudly (do not auto-delete -# -- an operator decides). +# diverges the live role from these artifacts. Warn-only (never auto-delete) is +# deliberate: this is a shared prod-tenant account and an extra policy might be +# a legitimate out-of-band grant an operator must adjudicate, not blindly strip. echo "==> Checking for unexpected policies on the role..." EXTRA_INLINE="$(aws --profile "${PROFILE}" iam list-role-policies \ --role-name "${ROLE_NAME}" --query "PolicyNames[?@!='${POLICY_NAME}']" --output text)"