mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-10-07 16:08:54 +00:00
Adam Moussa
c8450458e3
seahaven-slack-bot was decommissioned 2026-07-23 (stack DELETE_IN_PROGRESS,
consumer Lambdas gone); its successor sh-mcp is undeployed and uses
same-account DynamoDB access. So no live consumer reads these tables
cross-account. Per Adam's call, drop the cross-account grants entirely and
re-add correctly-scoped ones if/when sh-mcp deploys to a different account.
- Remove the four table resource policies + make_slack_bot_read_policy helper
+ its constants (cdk/common.py, po_stack.py, wo_stack.py) and the helper's
unit test. Both stacks synth with zero table ResourcePolicy.
- scripts/migrate_tables.py hardening (fixes from the sh-security-review
fan-out on the destructive backfill tool):
* validate --cutoff strictly (parse ISO-8601, require aware UTC, re-emit
canonical second-precision form) so a malformed cutoff can't silently
copy dual-window rows or drop history;
* reject `copy --all` up front (must run tables individually, in order,
with the stream-drain wait) instead of writing three tables then erroring;
* truncate backup gate now also checks recency (<1h) and TableId, not just
status+name;
* verify requires --cutoff whenever a cutoff table is in scope (else it
false-flags dual-window rows as MISSING);
* sticky-cancel is now PREVENTED copy-side (a non-Cancelled source item
never overwrites a dest-Cancelled PO), and the verify comment no longer
overstates what its source-side scan covers;
* spot-check all modes (truncate_load keys are verbatim, so key-existence
is sound there too).
- Deploy role: scope cloudformation:DescribeStacks to this repo's stacks +
CDKToolkit (was Resource:*, disclosed all tenant stacks in the shared prod
account); add a drift check warning on unexpected role policies and drop the
dead SMOKE_POLICY_NAME var; document the shared-account bootstrap-role
accepted risk in the deploy-role README.
40 lines
1.6 KiB
JSON
40 lines
1.6 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "AssumeCdkBootstrapRoles",
|
|
"Effect": "Allow",
|
|
"Action": "sts:AssumeRole",
|
|
"Resource": [
|
|
"arn:aws:iam::011934824531:role/cdk-hnb659fds-deploy-role-011934824531-us-east-1",
|
|
"arn:aws:iam::011934824531:role/cdk-hnb659fds-file-publishing-role-011934824531-us-east-1",
|
|
"arn:aws:iam::011934824531:role/cdk-hnb659fds-lookup-role-011934824531-us-east-1",
|
|
"arn:aws:iam::011934824531:role/cdk-hnb659fds-image-publishing-role-011934824531-us-east-1"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "CdkDeployHealthCheck",
|
|
"Effect": "Allow",
|
|
"Action": "cloudformation:DescribeStacks",
|
|
"Resource": [
|
|
"arn:aws:cloudformation:us-east-1:011934824531:stack/po-ingest/*",
|
|
"arn:aws:cloudformation:us-east-1:011934824531:stack/WorkorderIngestStack/*",
|
|
"arn:aws:cloudformation:us-east-1:011934824531:stack/CDKToolkit/*"
|
|
],
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"aws:RequestedRegion": "us-east-1"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "SmokeInvokeLambda",
|
|
"Effect": "Allow",
|
|
"Action": "lambda:InvokeFunction",
|
|
"Resource": [
|
|
"arn:aws:lambda:us-east-1:011934824531:function:po-email-processor",
|
|
"arn:aws:lambda:us-east-1:011934824531:function:workorder-email-processor"
|
|
]
|
|
}
|
|
]
|
|
}
|