mirror of
https://github.com/Sea-Haven-Industries/seahaven-account-baseline.git
synced 2026-08-04 16:56:14 +00:00
5d7ca83097
AWS Chatbot's control-plane API is homed in us-east-2, so every chatbot call carries aws:RequestedRegion=us-east-2 and is denied by the workloads-region-lock region deny (approved set = us-east-1/us-west-2). This blocked Slack workspace/channel setup in seahaven-prod (chatbot:GetSlackOauthParameters denied), which the prod site-alerts topic needs for Slack delivery. Adds chatbot:* to the SCP's global-service NotAction exemption list alongside iam/organizations/cloudfront/route53 — a region-agnostic full-prefix exemption, the same shape as the other global services. targetIds unchanged (workloads OU); regional services (s3/kms/logs) and the Bedrock carve-out untouched. GPT-4.1 cross-review: SAFE TO MERGE. /sh-security-review: block=false (0 confirmed critical/high). Security-OU region-lock deliberately NOT changed (runs no such workloads, same asymmetry as its missing Bedrock carve-out). |
||
|---|---|---|
| .. | ||
| scp | ||
| account-baseline-stack.ts | ||
| alarm-topic-stack.ts | ||
| backup-offsite-stack.ts | ||
| backup-stack.ts | ||
| bedrock-logging-regional.ts | ||
| bedrock-logging.ts | ||
| cis-monitoring.ts | ||
| detective-controls.ts | ||
| dynamodb-cmk-stack.ts | ||
| flow-logs.ts | ||
| governance-toggles.ts | ||
| logs-key.ts | ||
| member-baseline-stack.ts | ||
| org-governance-stack.ts | ||
| regional-baseline-stack.ts | ||
| ses-monitoring.ts | ||
| web-acl.ts | ||