Adam Moussa cf046089f4 iac(access): temporary shoc-assessment-dynamo-reader for Luby initial assessment (30-day, read-only) (#141) ... * iac(access): temporary shoc-assessment-dynamo-reader role for Luby initial assessment 30-day, read-only (GetItem/Query/Scan/DescribeTable) cross-account role in seahaven-prod trusting seahaven-external-dev, trust-policy hard expiry 2026-08-23. Steady state remains procurement-api + webhook; teardown script included. * harden(access): resolve sh-security-review findings on assessment reader C1 (confirmed medium): DateLessThan expiry condition duplicated into both permissions statements so in-flight sessions die at the deadline, not +1h. C2 (confirmed medium): teardown now strips ALL inline/attached policies and instance profiles before DeleteRole (kill-switch semantics restored, idempotent), emergency-revocation section added to README. Cheap hardenings: CDPATH-immune SCRIPT_DIR, MaxSessionDuration re-asserted on update path, data-handling expectations documented. * harden(access): address Open SWE review on #141 - Trust now requires ArnLike aws:PrincipalArn on the Identity Center role path (human SSO sessions only; string condition survives permission-set reprovisioning, unlike a role-ARN Principal pin) - README extend instructions cover BOTH expiry sites (trust + permissions) - Create script logs caller ARN + timestamp and validates the policy's KMS ARN against SSM /seahaven/dynamodb/cmk-arn before applying		2026-07-24 22:54:05 +00:00
..
deploy-role	feat(api): procurement-api read stack + OpenAPI docs (SHOC reconciliation path) (#127)	2026-07-23 19:32:20 -04:00
shoc-assessment-reader	iac(access): temporary shoc-assessment-dynamo-reader for Luby initial assessment (30-day, read-only) (#141)	2026-07-24 22:54:05 +00:00