adam/procurement-ingest
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/procurement-ingest.git synced 2026-10-07 16:08:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
procurement-ingest/infra/deploy-role/README.md
Adam Moussa c50ce7a3b3
feat(migration): prepare stacks and tooling for the seahaven-prod account move 
Phase 1 of the mgmt (328440206208) -> seahaven-prod (011934824531)
migration. No behavior change in-account; everything here is additive or
account-portability hygiene:

- infra/deploy-role/: reviewed OIDC deploy-role artifacts for prod
  (trust main-only, cdk-hnb659fds-* AssumeRole, smoke-invoke-lambda scoped
  to exactly the two email-processor fn ARNs). Codifies the previously
  out-of-band smoke-invoke grant.
- Table resource policies: make_slack_bot_read_policy in cdk/common.py,
  applied to purchase-orders, verified-sites, WorkOrders,
  WorkOrderComments (NOT pending-site-review; no bot consumer). Grants the
  mgmt-resident seahaven-slack-bot roles read-only cross-account access
  post-move (bot-side identity grants land in the slack-bot repo).
- scripts/migrate_tables.py: dry-run-default backfill tool implementing
  the plan's per-table semantics (superset overwrite, ingested_at cutoff
  for WorkOrderComments, backup-gated truncate-and-load for the two
  site tables) plus a verify subcommand (count parity, spot checks,
  sticky-Cancelled drift check).
- tests/test_resource_policy_helper.py: statement-shape unit tests +
  static pins that exactly the four bot-read tables carry the policy.
- Account-literal fixes: account-agnostic fixture bucket in
  test_reprocess_contract; runbook/README/po-template-parser account
  references updated to prod with historical mgmt notes; README gains the
  account-prerequisites list (imported-by-name dependencies).

deploy.yaml is deliberately unchanged (push-to-main auto-deploy kept).
Merge is held until migration Phase 0 completes; flipping the
AWS_DEPLOY_ROLE_ARN repo secret and merging this PR IS the first prod
deploy.
2026-07-23 14:40:09 -04:00

1.7 KiB
Raw Blame History

Deploy role: githubdeploy-procurement-ingest (seahaven-prod)

OIDC deploy role for this repo's GitHub Actions pipeline in AWS account 011934824531 (seahaven-prod), us-east-1. Created as part of the migration from the management account (328440206208); the mgmt role of the same name stays untouched until decommission as the emergency mgmt deploy path.

Files

File Purpose
trust-policy.json OIDC trust: repo:Sea-Haven-Industries/procurement-ingest:ref:refs/heads/main only
permissions-policy.json sts:AssumeRole on the four cdk-hnb659fds-* bootstrap roles, cloudformation:DescribeStacks (cd-cdk health check), and lambda:InvokeFunction on exactly the two email-processor function ARNs (post-deploy smoke gate)
create-deploy-role.sh Idempotent create-or-update from the two JSON files, profile seahaven-prod

Why the SmokeInvokeLambda statement exists

deploy.yaml runs scripts/post-deploy-smoke.sh under the deploy role's own session, not the assumed cdk-* roles. Without lambda:InvokeFunction on the two function ARNs the smoke gate hits AccessDenied and every deploy fails closed. The mgmt-era grant was applied out-of-band and undocumented; keeping it in these reviewed artifacts closes that gap. Scope it to exactly the two ARNs, never Resource: "*".

Change process

  1. Edit the JSON artifacts on a branch; both gates must pass on the exact files before anything is applied: GPT-4.1 cross-family review (cross_review.py) and /sh-security-review.
  2. Run ./create-deploy-role.sh (idempotent) with the seahaven-prod profile.
  3. Verify: aws iam simulate-principal-policy for the bootstrap-role AssumeRole and both InvokeFunction ARNs, then a real pipeline run.