adam/seahaven-account-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git synced 2026-08-04 16:56:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Extend deny-root-user SCP to the external-dev OU

Browse source 
Extdev root credentials were deleted 2026-07-14 via centralized root
management (four-surface verified), closing the deferred root-hardening
blocker. Root recovery is central (assume-root, drill-proven) plus a
temporary gated detach, so the OU now gets the same root lockout as the
other six.

Gates: GPT-4.1 cross-review APPROVE; /sh-security-review PASS (0 confirmed
critical/high). Note: this attach puts the extdev OU at the 5-SCP hard
quota - future guardrails attach at the account or consolidate.
This commit is contained in:
Adam Moussa 2026-07-14 18:19:27 -04:00
parent 2303a54ebc
commit 6afc803865
No known key found for this signature in database
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lib/org-governance-stack.ts
View file

@ -305,6 +305,7 @@ export class OrgGovernanceStack extends cdk.Stack {
securityOu.attrId,
sandboxOu.attrId,
graveyardOu.attrId,
"ou-nbuj-q34yz3ql", // external-dev (imported below; literal id matches its other SCP attachments)
],
content: {
Version: "2012-10-17",