mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-10-07 16:08:55 +00:00
fix(iam): keep paychex allow-list after door-unlock merge
This commit is contained in:
commit
0c05f629b3
2 changed files with 382 additions and 4 deletions
|
|
@ -147,14 +147,16 @@ Description: >-
|
|||
# seahaven-lambda-execution-boundary-procurement-ingest: 3977 / 11 statements
|
||||
# seahaven-lambda-execution-boundary-meal-order-manager: 2380 / 10 statements
|
||||
# seahaven-lambda-execution-boundary-seahaven-site: 1159 / 6 statements
|
||||
# seahaven-lambda-execution-boundary-seahaven-door-unlock-api: measure after deploy (PLAT-76)
|
||||
# seahaven-lambda-execution-boundary-paychex-integrations: floor-only (PLAT-120)
|
||||
# Dev copies are floor-only (691 / 4) via IsProdAccount.
|
||||
#
|
||||
# Guardrail PolicyDocuments also cap at 6,144. Each extra allow-list ARN
|
||||
# is copied into four Sids in EACH of SamCfnIamManagementPolicy and
|
||||
# HcptfIamManagementPolicy. Measured after this list (7 ARNs, PLAT-120):
|
||||
# seahaven-cfn-exec-iam-management: 4571 / 10 statements before seventh ARN
|
||||
# seahaven-hcptf-iam-management: 4693 / 10 statements before seventh ARN
|
||||
# HcptfIamManagementPolicy. Measured after PLAT-76 (7 ARNs):
|
||||
# seahaven-cfn-exec-iam-management: 4571 / 10 statements (1573 headroom)
|
||||
# seahaven-hcptf-iam-management: 4693 / 10 statements (1451 headroom)
|
||||
# PLAT-120 adds an 8th ARN (paychex-integrations). Re-measure after deploy.
|
||||
#
|
||||
# CRITICAL: a role has exactly ONE permissions boundary, so statements cannot
|
||||
# be spilled into a second attached managed policy. Do not introduce
|
||||
|
|
@ -1132,6 +1134,47 @@ Resources:
|
|||
- !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/*"
|
||||
- !Ref AWS::NoValue
|
||||
|
||||
DoorUnlockApiBoundary:
|
||||
Type: AWS::IAM::ManagedPolicy
|
||||
Properties:
|
||||
ManagedPolicyName: seahaven-lambda-execution-boundary-seahaven-door-unlock-api
|
||||
Description: >-
|
||||
Per-workload permissions boundary for seahaven-door-unlock-api
|
||||
(PLAT-76 / PLAT-52). Floor plus exact prod SSM parameter ARNs and
|
||||
3CX secret ARNs. Shared policy remains the live-role ceiling
|
||||
until app retarget.
|
||||
PolicyDocument:
|
||||
Version: "2012-10-17"
|
||||
Statement:
|
||||
# Floor aliases — edit the &lambdaBoundaryFloor* anchors on
|
||||
# AfiBackupMonitorBoundary only; do not inline a divergent copy.
|
||||
- *lambdaBoundaryFloorLogsWrite
|
||||
- *lambdaBoundaryFloorLogsDescribe
|
||||
- *lambdaBoundaryFloorXRay
|
||||
- *lambdaBoundaryFloorEc2Eni
|
||||
- !If
|
||||
- IsProdAccount
|
||||
- Sid: DoorUnlockApiSsm
|
||||
Effect: Allow
|
||||
Action:
|
||||
- ssm:GetParameter
|
||||
Resource:
|
||||
- arn:aws:ssm:us-east-1:011934824531:parameter/seahaven/door-unlock/elements-api-key
|
||||
- arn:aws:ssm:us-east-1:011934824531:parameter/seahaven/door-unlock/auth-token
|
||||
- arn:aws:ssm:us-east-1:011934824531:parameter/seahaven/door-unlock/door-id
|
||||
- !Ref AWS::NoValue
|
||||
- !If
|
||||
- IsProdAccount
|
||||
- Sid: DoorUnlockApiSecrets
|
||||
Effect: Allow
|
||||
Action:
|
||||
- secretsmanager:GetSecretValue
|
||||
Resource:
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-domain-TPwqWP
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-client-id-jzyQXb
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-client-secret-jpO476
|
||||
- !Ref AWS::NoValue
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Shared CloudFormation execution role (SAM stacks) — INFRA-97 scoped
|
||||
#
|
||||
|
|
@ -1676,6 +1719,7 @@ Resources:
|
|||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-procurement-ingest"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-meal-order-manager"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-seahaven-site"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-seahaven-door-unlock-api"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-paychex-integrations"
|
||||
|
||||
# Attach managed policies — MUST have boundary already on role
|
||||
|
|
|
|||
|
|
@ -83,7 +83,8 @@ Description: >-
|
|||
# — the same wall the role INLINE limit (10,240 bytes) put the first
|
||||
# deploy-substrate deploy into on 2026-07-27. Compact size recorded after
|
||||
# synth with 6 ARNs: 4693 characters / 10 statements (1451 headroom).
|
||||
# PLAT-120 adds a seventh allow-list ARN (~380 characters across four Sids).
|
||||
# PLAT-76 added a seventh ARN. PLAT-120 adds an eighth (paychex-integrations,
|
||||
# ~380 characters across four Sids). Re-measure after deploy.
|
||||
#
|
||||
# PER-WORKSPACE ROLE ACCUMULATOR
|
||||
# At each stack's migration, a PR appends to this template:
|
||||
|
|
@ -212,6 +213,7 @@ Resources:
|
|||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-procurement-ingest"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-meal-order-manager"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-seahaven-site"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-seahaven-door-unlock-api"
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-paychex-integrations"
|
||||
|
||||
# Attach managed policies — MUST have boundary already on role
|
||||
|
|
@ -2165,3 +2167,335 @@ Resources:
|
|||
}
|
||||
]
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# seahaven-door-unlock-api-prod (PLAT-76) — HttpApi + 5 Lambdas + EventBridge
|
||||
# + ACM custom domain + alarms. Plan role: ViewOnly + plan-refresh sidecar.
|
||||
# Apply role: HcptfIamManagement + prefix-scoped service wildcards.
|
||||
# ---------------------------------------------------------------------------
|
||||
HcptfDoorUnlockApiPlanRole:
|
||||
Type: AWS::IAM::Role
|
||||
Condition: IsProdAccount
|
||||
Properties:
|
||||
RoleName: hcptf-seahaven-door-unlock-api-plan
|
||||
AssumeRolePolicyDocument:
|
||||
Version: "2012-10-17"
|
||||
Statement:
|
||||
- Effect: Allow
|
||||
Principal:
|
||||
Federated: !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/app.terraform.io"
|
||||
Action: sts:AssumeRoleWithWebIdentity
|
||||
Condition:
|
||||
StringEquals:
|
||||
"app.terraform.io:aud": aws.workload.identity
|
||||
"app.terraform.io:sub": organization:seahaven:project:seahaven-prod:workspace:seahaven-door-unlock-api-prod:run_phase:plan
|
||||
ManagedPolicyArns:
|
||||
- arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
|
||||
Policies:
|
||||
- PolicyName: seahaven-door-unlock-api-plan-refresh
|
||||
PolicyDocument:
|
||||
Version: "2012-10-17"
|
||||
Statement:
|
||||
- Sid: RefreshIamRoles
|
||||
Effect: Allow
|
||||
Action:
|
||||
- iam:GetRole
|
||||
- iam:GetRolePolicy
|
||||
- iam:ListRolePolicies
|
||||
- iam:ListAttachedRolePolicies
|
||||
- iam:ListRoleTags
|
||||
Resource:
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/door-unlock-api-*"
|
||||
- Sid: RefreshManagedPolicies
|
||||
Effect: Allow
|
||||
Action:
|
||||
- iam:GetPolicy
|
||||
- iam:GetPolicyVersion
|
||||
Resource: "*"
|
||||
- Sid: RefreshEventBridge
|
||||
Effect: Allow
|
||||
Action:
|
||||
- events:DescribeRule
|
||||
- events:ListTargetsByRule
|
||||
- events:ListTagsForResource
|
||||
Resource:
|
||||
- !Sub "arn:aws:events:us-east-1:${AWS::AccountId}:rule/door-unlock-api-*"
|
||||
- Sid: RefreshLambda
|
||||
Effect: Allow
|
||||
Action:
|
||||
- lambda:Get*
|
||||
- lambda:List*
|
||||
Resource:
|
||||
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:door-unlock-api-*"
|
||||
- Sid: RefreshBuckets
|
||||
Effect: Allow
|
||||
Action:
|
||||
- s3:Get*
|
||||
- s3:ListBucket
|
||||
Resource:
|
||||
- !Sub "arn:aws:s3:::door-unlock-api-artifacts-${AWS::AccountId}"
|
||||
- !Sub "arn:aws:s3:::door-unlock-api-artifacts-${AWS::AccountId}/*"
|
||||
- Sid: RefreshLogs
|
||||
Effect: Allow
|
||||
Action:
|
||||
- logs:DescribeLogGroups
|
||||
- logs:ListTagsForResource
|
||||
Resource: "*"
|
||||
- Sid: RefreshAcm
|
||||
Effect: Allow
|
||||
Action:
|
||||
- acm:DescribeCertificate
|
||||
- acm:ListCertificates
|
||||
- acm:ListTagsForCertificate
|
||||
- acm:GetCertificate
|
||||
Resource: "*"
|
||||
# String door-id only. SecureString auth-token / elements-api-key
|
||||
# stay off the plan role so speculative runs cannot render them.
|
||||
- Sid: RefreshDoorUnlockSsm
|
||||
Effect: Allow
|
||||
Action:
|
||||
- ssm:GetParameter
|
||||
- ssm:GetParameters
|
||||
Resource:
|
||||
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/door-id"
|
||||
- Sid: RefreshDoorUnlockSsmTags
|
||||
Effect: Allow
|
||||
Action:
|
||||
- ssm:ListTagsForResource
|
||||
Resource:
|
||||
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/*"
|
||||
- Sid: RefreshSsmDescribeParameters
|
||||
Effect: Allow
|
||||
Action:
|
||||
- ssm:DescribeParameters
|
||||
Resource: "*"
|
||||
- Sid: RefreshHttpApi
|
||||
Effect: Allow
|
||||
Action:
|
||||
- apigateway:GET
|
||||
Resource:
|
||||
- !Sub "arn:aws:apigateway:us-east-1::/apis/*"
|
||||
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com
|
||||
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com/*
|
||||
- !Sub "arn:aws:apigateway:us-east-1::/tags/*"
|
||||
- Sid: RefreshAlarms
|
||||
Effect: Allow
|
||||
Action:
|
||||
- cloudwatch:DescribeAlarms
|
||||
- cloudwatch:ListTagsForResource
|
||||
Resource: "*"
|
||||
- Sid: RefreshThreeCxSecrets
|
||||
Effect: Allow
|
||||
Action:
|
||||
- secretsmanager:DescribeSecret
|
||||
Resource:
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-domain-TPwqWP
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-client-id-jzyQXb
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-client-secret-jpO476
|
||||
|
||||
HcptfDoorUnlockApiApplyRole:
|
||||
Type: AWS::IAM::Role
|
||||
Condition: IsProdAccount
|
||||
Properties:
|
||||
RoleName: hcptf-seahaven-door-unlock-api
|
||||
AssumeRolePolicyDocument:
|
||||
Version: "2012-10-17"
|
||||
Statement:
|
||||
- Effect: Allow
|
||||
Principal:
|
||||
Federated: !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/app.terraform.io"
|
||||
Action: sts:AssumeRoleWithWebIdentity
|
||||
Condition:
|
||||
StringEquals:
|
||||
"app.terraform.io:aud": aws.workload.identity
|
||||
"app.terraform.io:sub": organization:seahaven:project:seahaven-prod:workspace:seahaven-door-unlock-api-prod:run_phase:apply
|
||||
ManagedPolicyArns:
|
||||
- !Ref HcptfIamManagementPolicy
|
||||
Policies:
|
||||
- PolicyName: seahaven-door-unlock-api-services
|
||||
PolicyDocument:
|
||||
Version: "2012-10-17"
|
||||
Statement:
|
||||
- Sid: LambdaAll
|
||||
Effect: Allow
|
||||
Action:
|
||||
- lambda:*
|
||||
Resource:
|
||||
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:door-unlock-api-*"
|
||||
- Sid: LambdaList
|
||||
Effect: Allow
|
||||
Action:
|
||||
- lambda:ListFunctions
|
||||
- lambda:GetAccountSettings
|
||||
Resource: "*"
|
||||
- Sid: EventBridgeRules
|
||||
Effect: Allow
|
||||
Action:
|
||||
- events:*
|
||||
Resource:
|
||||
- !Sub "arn:aws:events:us-east-1:${AWS::AccountId}:rule/door-unlock-api-*"
|
||||
- Sid: CloudWatchLogs
|
||||
Effect: Allow
|
||||
Action:
|
||||
- logs:CreateLogGroup
|
||||
- logs:DeleteLogGroup
|
||||
- logs:PutRetentionPolicy
|
||||
- logs:DeleteRetentionPolicy
|
||||
- logs:TagResource
|
||||
- logs:UntagResource
|
||||
- logs:ListTagsForResource
|
||||
Resource:
|
||||
- !Sub "arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/lambda/door-unlock-api-*"
|
||||
- !Sub "arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/apigateway/door-unlock-api*"
|
||||
- Sid: CloudWatchLogsDescribe
|
||||
Effect: Allow
|
||||
Action:
|
||||
- logs:DescribeLogGroups
|
||||
Resource: "*"
|
||||
- Sid: DoorUnlockApiGwAccessLogDelivery
|
||||
Effect: Allow
|
||||
Action:
|
||||
- logs:CreateLogDelivery
|
||||
- logs:GetLogDelivery
|
||||
- logs:UpdateLogDelivery
|
||||
- logs:DeleteLogDelivery
|
||||
- logs:ListLogDeliveries
|
||||
- logs:DescribeResourcePolicies
|
||||
Resource: "*"
|
||||
- Sid: StackBuckets
|
||||
Effect: Allow
|
||||
Action:
|
||||
- s3:*
|
||||
Resource:
|
||||
- !Sub "arn:aws:s3:::door-unlock-api-artifacts-${AWS::AccountId}"
|
||||
- !Sub "arn:aws:s3:::door-unlock-api-artifacts-${AWS::AccountId}/*"
|
||||
# HTTP API ids are allocated at create (same as meal-order).
|
||||
# Custom domain is hostname-pinned like procurement-api.
|
||||
- Sid: HttpApiManage
|
||||
Effect: Allow
|
||||
Action:
|
||||
- apigateway:*
|
||||
Resource:
|
||||
- !Sub "arn:aws:apigateway:us-east-1::/apis"
|
||||
- !Sub "arn:aws:apigateway:us-east-1::/apis/*"
|
||||
- !Sub "arn:aws:apigateway:us-east-1::/tags/*"
|
||||
- Sid: HttpApiDomain
|
||||
Effect: Allow
|
||||
Action:
|
||||
- apigateway:*
|
||||
Resource:
|
||||
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com
|
||||
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com/*
|
||||
- Sid: AcmCreate
|
||||
Effect: Allow
|
||||
Action:
|
||||
- acm:RequestCertificate
|
||||
Resource: "*"
|
||||
Condition:
|
||||
StringEquals:
|
||||
"aws:RequestTag/Project": seahaven-door-unlock-api
|
||||
- Sid: AcmList
|
||||
Effect: Allow
|
||||
Action:
|
||||
- acm:ListCertificates
|
||||
- acm:ListTagsForCertificate
|
||||
Resource: "*"
|
||||
- Sid: AcmManageTagged
|
||||
Effect: Allow
|
||||
Action:
|
||||
- acm:DescribeCertificate
|
||||
- acm:GetCertificate
|
||||
- acm:DeleteCertificate
|
||||
- acm:AddTagsToCertificate
|
||||
- acm:RemoveTagsFromCertificate
|
||||
- acm:RenewCertificate
|
||||
Resource: "*"
|
||||
Condition:
|
||||
StringEquals:
|
||||
"aws:ResourceTag/Project": seahaven-door-unlock-api
|
||||
# HCP reads the String door-id data source only. Lambda execution
|
||||
# roles (not this apply role) GetParameter the SecureStrings.
|
||||
- Sid: DoorUnlockSsm
|
||||
Effect: Allow
|
||||
Action:
|
||||
- ssm:GetParameter
|
||||
- ssm:GetParameters
|
||||
Resource:
|
||||
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/door-id"
|
||||
- Sid: DoorUnlockSsmTags
|
||||
Effect: Allow
|
||||
Action:
|
||||
- ssm:ListTagsForResource
|
||||
Resource:
|
||||
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/*"
|
||||
- Sid: DoorUnlockSsmDescribeParameters
|
||||
Effect: Allow
|
||||
Action:
|
||||
- ssm:DescribeParameters
|
||||
Resource: "*"
|
||||
- Sid: DescribeThreeCxSecrets
|
||||
Effect: Allow
|
||||
Action:
|
||||
- secretsmanager:DescribeSecret
|
||||
Resource:
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-domain-TPwqWP
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-client-id-jzyQXb
|
||||
- arn:aws:secretsmanager:us-east-1:011934824531:secret:afterhours-shift-manager/3cx-client-secret-jpO476
|
||||
- Sid: DoorUnlockPassRoleApiGateway
|
||||
Effect: Allow
|
||||
Action:
|
||||
- iam:PassRole
|
||||
Resource:
|
||||
- !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/door-unlock-api-*"
|
||||
Condition:
|
||||
StringEquals:
|
||||
"iam:PassedToService": "apigateway.amazonaws.com"
|
||||
- Sid: CloudWatchAlarms
|
||||
Effect: Allow
|
||||
Action:
|
||||
- cloudwatch:PutMetricAlarm
|
||||
- cloudwatch:DeleteAlarms
|
||||
- cloudwatch:DescribeAlarms
|
||||
- cloudwatch:TagResource
|
||||
- cloudwatch:UntagResource
|
||||
- cloudwatch:ListTagsForResource
|
||||
Resource:
|
||||
- !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:door-unlock-api-*"
|
||||
- Sid: SnsPublishSiteAlerts
|
||||
Effect: Allow
|
||||
Action:
|
||||
- sns:Publish
|
||||
- sns:GetTopicAttributes
|
||||
- sns:ListTagsForResource
|
||||
Resource:
|
||||
- !Sub "arn:aws:sns:us-east-1:${AWS::AccountId}:site-alerts"
|
||||
|
||||
DoorUnlockApiAccessLogResourcePolicy:
|
||||
Type: AWS::Logs::ResourcePolicy
|
||||
Condition: IsProdAccount
|
||||
Properties:
|
||||
PolicyName: DoorUnlockApiAccessLogDelivery
|
||||
PolicyDocument: !Sub |
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AWSLogDeliveryWrite",
|
||||
"Effect": "Allow",
|
||||
"Principal": { "Service": "delivery.logs.amazonaws.com" },
|
||||
"Action": [
|
||||
"logs:CreateLogStream",
|
||||
"logs:PutLogEvents"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/apigateway/door-unlock-api",
|
||||
"arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/apigateway/door-unlock-api:*"
|
||||
],
|
||||
"Condition": {
|
||||
"StringEquals": {
|
||||
"aws:SourceAccount": "${AWS::AccountId}"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue