mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-10-07 16:08:54 +00:00
Adam Moussa
c50ce7a3b3
Phase 1 of the mgmt (328440206208) -> seahaven-prod (011934824531) migration. No behavior change in-account; everything here is additive or account-portability hygiene: - infra/deploy-role/: reviewed OIDC deploy-role artifacts for prod (trust main-only, cdk-hnb659fds-* AssumeRole, smoke-invoke-lambda scoped to exactly the two email-processor fn ARNs). Codifies the previously out-of-band smoke-invoke grant. - Table resource policies: make_slack_bot_read_policy in cdk/common.py, applied to purchase-orders, verified-sites, WorkOrders, WorkOrderComments (NOT pending-site-review; no bot consumer). Grants the mgmt-resident seahaven-slack-bot roles read-only cross-account access post-move (bot-side identity grants land in the slack-bot repo). - scripts/migrate_tables.py: dry-run-default backfill tool implementing the plan's per-table semantics (superset overwrite, ingested_at cutoff for WorkOrderComments, backup-gated truncate-and-load for the two site tables) plus a verify subcommand (count parity, spot checks, sticky-Cancelled drift check). - tests/test_resource_policy_helper.py: statement-shape unit tests + static pins that exactly the four bot-read tables carry the policy. - Account-literal fixes: account-agnostic fixture bucket in test_reprocess_contract; runbook/README/po-template-parser account references updated to prod with historical mgmt notes; README gains the account-prerequisites list (imported-by-name dependencies). deploy.yaml is deliberately unchanged (push-to-main auto-deploy kept). Merge is held until migration Phase 0 completes; flipping the AWS_DEPLOY_ROLE_ARN repo secret and merging this PR IS the first prod deploy.
32 lines
1.7 KiB
Markdown
32 lines
1.7 KiB
Markdown
# Deploy role: githubdeploy-procurement-ingest (seahaven-prod)
|
|
|
|
OIDC deploy role for this repo's GitHub Actions pipeline in AWS account
|
|
`011934824531` (seahaven-prod), us-east-1. Created as part of the migration
|
|
from the management account (328440206208); the mgmt role of the same name
|
|
stays untouched until decommission as the emergency mgmt deploy path.
|
|
|
|
## Files
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `trust-policy.json` | OIDC trust: `repo:Sea-Haven-Industries/procurement-ingest:ref:refs/heads/main` only |
|
|
| `permissions-policy.json` | `sts:AssumeRole` on the four `cdk-hnb659fds-*` bootstrap roles, `cloudformation:DescribeStacks` (cd-cdk health check), and `lambda:InvokeFunction` on exactly the two email-processor function ARNs (post-deploy smoke gate) |
|
|
| `create-deploy-role.sh` | Idempotent create-or-update from the two JSON files, profile `seahaven-prod` |
|
|
|
|
## Why the SmokeInvokeLambda statement exists
|
|
|
|
`deploy.yaml` runs `scripts/post-deploy-smoke.sh` under the deploy role's own
|
|
session, not the assumed `cdk-*` roles. Without `lambda:InvokeFunction` on the
|
|
two function ARNs the smoke gate hits AccessDenied and every deploy fails
|
|
closed. The mgmt-era grant was applied out-of-band and undocumented; keeping
|
|
it in these reviewed artifacts closes that gap. Scope it to exactly the two
|
|
ARNs, never `Resource: "*"`.
|
|
|
|
## Change process
|
|
|
|
1. Edit the JSON artifacts on a branch; both gates must pass on the exact
|
|
files before anything is applied: GPT-4.1 cross-family review
|
|
(cross_review.py) and /sh-security-review.
|
|
2. Run `./create-deploy-role.sh` (idempotent) with the seahaven-prod profile.
|
|
3. Verify: `aws iam simulate-principal-policy` for the bootstrap-role
|
|
AssumeRole and both InvokeFunction ARNs, then a real pipeline run.
|