From 5dab14ce68ecf5bddd1dd0683cc6ddce837c7912 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 23 Jul 2026 14:28:10 -0400 Subject: [PATCH] feat(prod): add seahaven-prod DynamoDB CMK and site-alerts alarm-topic stacks Provisions the two shared dependencies procurement-ingest imports by name, ahead of its migration from mgmt to seahaven-prod: - dynamodb-cmk-prod: second DynamoDbCmkStack instance (same stack name, prod account) creating alias/seahaven-dynamodb + the /seahaven/dynamodb/cmk-arn SSM param. Adds a cross-account key-policy statement so the mgmt seahaven-slack-bot roles can keep reading the CMK-encrypted purchase-orders table after it moves (ViaService + PrincipalArn-wildcard scoped; identity-policy half lands in the slack-bot repo's cutover PR). - alarm-topic-prod: codified site-alerts SNS topic + seahaven-alarm-topics CMK with the cloudwatch.amazonaws.com publish grant (mirrors the working mgmt pattern; mgmt's topic remains CLI-managed debt). - deploy.yaml: both appended to the deploy-prod job's explicit stack list (SH-ORG-005 rule: unlisted stacks silently never deploy). --- .github/workflows/deploy.yaml | 2 +- bin/app.ts | 41 +++++++++++++++++++++ lib/alarm-topic-stack.ts | 68 +++++++++++++++++++++++++++++++++++ 3 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 lib/alarm-topic-stack.ts diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml index b537091..f956e0c 100644 --- a/.github/workflows/deploy.yaml +++ b/.github/workflows/deploy.yaml @@ -55,7 +55,7 @@ jobs: uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@3cde673b9d05c0e68aac4d997d582f2543853d20 # main with: node-version: "24" - stacks: "prod-baseline" + stacks: "prod-baseline dynamodb-cmk-prod alarm-topic-prod" stack-name: "seahaven-prod-baseline" secrets: deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN_PROD }} diff --git a/bin/app.ts b/bin/app.ts index 945180a..14aee94 100644 --- a/bin/app.ts +++ b/bin/app.ts @@ -1,7 +1,9 @@ #!/usr/bin/env node import "source-map-support/register"; import * as cdk from "aws-cdk-lib"; +import * as iam from "aws-cdk-lib/aws-iam"; import { AccountBaselineStack } from "../lib/account-baseline-stack"; +import { AlarmTopicStack } from "../lib/alarm-topic-stack"; import { BackupOffsiteStack } from "../lib/backup-offsite-stack"; import { BackupStack } from "../lib/backup-stack"; import { RegionalBaselineStack } from "../lib/regional-baseline-stack"; @@ -165,6 +167,45 @@ new DynamoDbCmkStack(app, "dynamodb-cmk", { env: { account: ACCOUNT, region: "us-east-1" }, }); +// ── seahaven-prod copies for the procurement-ingest migration ──────────────── +// procurement-ingest is moving from mgmt to seahaven-prod; its stacks resolve +// the DynamoDB CMK via SSM /seahaven/dynamodb/cmk-arn and import the SNS topic +// `site-alerts` by constructed in-account ARN, so both must exist in prod +// BEFORE that app's first prod deploy. Same stack names as mgmt (unique +// per-account); distinct CDK ids. +const prodDynamoCmk = new DynamoDbCmkStack(app, "dynamodb-cmk-prod", { + stackName: "seahaven-dynamodb-cmk", + env: { account: PROD_ACCOUNT, region: "us-east-1" }, +}); + +// seahaven-slack-bot stays in mgmt but reads the CMK-encrypted purchase-orders +// table cross-account after the migration. The base statement's +// kms:CallerAccount pin (correctly) excludes foreign callers, so the mgmt bot +// roles need their own statement. Delegation-to-IAM per this stack's header: +// PrincipalArn is wildcarded by stack prefix because CFN role suffixes rotate; +// each bot role must ALSO carry an identity-policy grant on this key ARN +// (added in the slack-bot repo's cutover PR). +prodDynamoCmk.key.addToResourcePolicy( + new iam.PolicyStatement({ + sid: "AllowMgmtSlackBotReadViaDynamoDb", + effect: iam.Effect.ALLOW, + principals: [new iam.AccountPrincipal(ACCOUNT)], + actions: ["kms:Decrypt", "kms:DescribeKey"], + resources: ["*"], + conditions: { + StringEquals: { "kms:ViaService": "dynamodb.us-east-1.amazonaws.com" }, + ArnLike: { + "aws:PrincipalArn": `arn:aws:iam::${ACCOUNT}:role/seahaven-slack-bot-*`, + }, + }, + }), +); + +new AlarmTopicStack(app, "alarm-topic-prod", { + stackName: "seahaven-alarm-topic", + env: { account: PROD_ACCOUNT, region: "us-east-1" }, +}); + // ── Secondary-region baselines (INFRA-16, INFRA-91) ────────────────────────── // The us-east-1 baseline above is region-pinned by design. These stacks extend // a minimal detective/logging footprint into the secondary regions, codifying diff --git a/lib/alarm-topic-stack.ts b/lib/alarm-topic-stack.ts new file mode 100644 index 0000000..26c5389 --- /dev/null +++ b/lib/alarm-topic-stack.ts @@ -0,0 +1,68 @@ +import * as cdk from "aws-cdk-lib"; +import * as kms from "aws-cdk-lib/aws-kms"; +import * as iam from "aws-cdk-lib/aws-iam"; +import * as sns from "aws-cdk-lib/aws-sns"; +import { Construct } from "constructs"; + +/** + * Shared CloudWatch-alarm SNS topic (`site-alerts`) + its CMK for a member + * account. First tenant: seahaven-prod, for the procurement-ingest migration + * (its stacks import the topic by constructed ARN `site-alerts` in-account). + * + * mgmt's equivalent topic is unmanaged (created via CLI, acknowledged debt in + * cis-monitoring.ts) - this stack codifies the same working pattern instead of + * replicating the debt: + * - CMK `alias/seahaven-alarm-topics`, NOT alias/aws/sns: the AWS-managed SNS + * key's policy cannot grant cloudwatch.amazonaws.com, so alarms silently + * fail to publish through it. + * - Key policy grants cloudwatch.amazonaws.com only (SourceAccount-scoped). + * Subscribers (AWS Chatbot -> Slack) need no KMS grant: SNS decrypts at + * delivery. Verified live by mgmt's site-alerts + Chatbot wiring. + * - Chatbot workspace auth + channel config are console-only (per-account) + * and deliberately out of scope here; verify delivery post-deploy with + * `aws sns publish` + a Slack message check. + */ +export class AlarmTopicStack extends cdk.Stack { + public readonly topic: sns.Topic; + + constructor(scope: Construct, id: string, props?: cdk.StackProps) { + super(scope, id, props); + + const alarmTopicKey = new kms.Key(this, "AlarmTopicKey", { + alias: "seahaven-alarm-topics", + description: + "SSE for SNS alarm topics; grants CloudWatch alarms publish-side usage", + enableKeyRotation: true, + removalPolicy: cdk.RemovalPolicy.RETAIN, + }); + // GenerateDataKey* is the publish-side envelope-encryption call CloudWatch + // makes when writing to an encrypted topic; Decrypt covers retried + // deliveries re-reading its own envelope. Both are required for alarms to + // publish at all. + alarmTopicKey.addToResourcePolicy( + new iam.PolicyStatement({ + sid: "AllowCloudWatchAlarmsUse", + principals: [new iam.ServicePrincipal("cloudwatch.amazonaws.com")], + actions: ["kms:GenerateDataKey*", "kms:Decrypt", "kms:DescribeKey"], + resources: ["*"], + conditions: { + StringEquals: { "aws:SourceAccount": this.account }, + }, + }), + ); + + this.topic = new sns.Topic(this, "SiteAlertsTopic", { + topicName: "site-alerts", + displayName: "Sea Haven operational alarms", + masterKey: alarmTopicKey, + }); + + cdk.Tags.of(this).add("Project", "account-baseline"); + cdk.Tags.of(this).add("Owner", "adam@seahavenind.com"); + cdk.Tags.of(this).add("Environment", "prod"); + cdk.Tags.of(this).add("ManagedBy", "cdk"); + + new cdk.CfnOutput(this, "SiteAlertsTopicArn", { value: this.topic.topicArn }); + new cdk.CfnOutput(this, "AlarmTopicKeyArn", { value: alarmTopicKey.keyArn }); + } +}