mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-09-30 08:23:14 +00:00
cf046089f4
* iac(access): temporary shoc-assessment-dynamo-reader role for Luby initial assessment 30-day, read-only (GetItem/Query/Scan/DescribeTable) cross-account role in seahaven-prod trusting seahaven-external-dev, trust-policy hard expiry 2026-08-23. Steady state remains procurement-api + webhook; teardown script included. * harden(access): resolve sh-security-review findings on assessment reader C1 (confirmed medium): DateLessThan expiry condition duplicated into both permissions statements so in-flight sessions die at the deadline, not +1h. C2 (confirmed medium): teardown now strips ALL inline/attached policies and instance profiles before DeleteRole (kill-switch semantics restored, idempotent), emergency-revocation section added to README. Cheap hardenings: CDPATH-immune SCRIPT_DIR, MaxSessionDuration re-asserted on update path, data-handling expectations documented. * harden(access): address Open SWE review on #141 - Trust now requires ArnLike aws:PrincipalArn on the Identity Center role path (human SSO sessions only; string condition survives permission-set reprovisioning, unlike a role-ARN Principal pin) - README extend instructions cover BOTH expiry sites (trust + permissions) - Create script logs caller ARN + timestamp and validates the policy's KMS ARN against SSM /seahaven/dynamodb/cmk-arn before applying
46 lines
1.6 KiB
JSON
46 lines
1.6 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "ReadProcurementTables",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"dynamodb:GetItem",
|
|
"dynamodb:Query",
|
|
"dynamodb:Scan",
|
|
"dynamodb:DescribeTable"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/purchase-orders",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/purchase-orders/index/*",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/verified-sites",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/verified-sites/index/*",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/pending-site-review",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/pending-site-review/index/*",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/WorkOrders",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/WorkOrders/index/*",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/WorkOrderComments",
|
|
"arn:aws:dynamodb:us-east-1:011934824531:table/WorkOrderComments/index/*"
|
|
],
|
|
"Condition": {
|
|
"DateLessThan": {
|
|
"aws:CurrentTime": "2026-08-23T00:00:00Z"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "DecryptTableCmkViaDynamo",
|
|
"Effect": "Allow",
|
|
"Action": "kms:Decrypt",
|
|
"Resource": "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"kms:ViaService": "dynamodb.us-east-1.amazonaws.com"
|
|
},
|
|
"DateLessThan": {
|
|
"aws:CurrentTime": "2026-08-23T00:00:00Z"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|