Adam Moussa 47fa35688d fix(po): grant KMS on seahaven-dynamodb CMK to purchase-orders consumers (INFRA-104) (#56) ... The purchase-orders table was migrated to SSE-KMS (alias/seahaven-dynamodb, INFRA-95/M-3) out-of-band, but po_stack never declared the key, so grant_read_write_data did not propagate kms perms. po-email-processor failed ~99.6% of invocations with kms:Decrypt AccessDeniedException, a data-loss outage on the PO ingestion write path. - po_stack: declare encryption_key on purchase-orders (reconciles SSE drift; no-op against the already-encrypted live table) so the existing grants add kms:Decrypt/GenerateDataKey/DescribeKey to EmailProcessor, WebUI, SiteExtractor. - wo_stack: pre-emptive grant_encrypt_decrypt on the WO processor role ahead of the WorkOrders CMK migration (INFRA-6); tables left unencrypted, no table change. GPT-4.1 cross-review: no blockers.		2026-06-10 19:31:55 -04:00
..
app.py	Merge workorder-ingest into unified procurement repo (#22)	2026-05-12 15:21:06 -04:00
cdk.json	Initial commit: PO email ingestion pipeline	2026-04-07 12:12:30 -04:00
po_stack.py	fix(po): grant KMS on seahaven-dynamodb CMK to purchase-orders consumers (INFRA-104) (#56)	2026-06-10 19:31:55 -04:00
requirements.txt	Bump aws-cdk-lib in /cdk in the minor-and-patch group (#48)	2026-06-05 14:49:27 -04:00
wo_stack.py	fix(po): grant KMS on seahaven-dynamodb CMK to purchase-orders consumers (INFRA-104) (#56)	2026-06-10 19:31:55 -04:00