adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-09-30 06:53:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat(iam): allow frontend HCP apply to update exact CloudFront resources (PLAT-187) (#142)
Some checks are pending
Deploy / deploy-management (push) Waiting to run
Details
Deploy / deploy-external-dev (push) Waiting to run
Details
Deploy / deploy-security (push) Waiting to run
Details
Deploy / deploy-dev (push) Waiting to run
Details
Deploy / deploy-prod (push) Waiting to run
Details

Browse source 
* feat(iam): allow frontend HCP apply to update exact CloudFront resources (PLAT-187)

Phase 2 ownership tags cannot apply while UpdateDistribution and UpdateFunction are denied on *. Allow those two actions only on the pinned distribution and function ARNs.

* fix(iam): allow PublishFunction on exact frontend CloudFront functions (PLAT-187)

The AWS provider publishes after UpdateFunction, including tag-only applies, so denying PublishFunction on * still blocked Phase 2 function updates.
This commit is contained in:
Adam Moussa 2026-09-11 15:08:21 +00:00 • committed by GitHub
parent a829854cd0
commit 0c6f307b61
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 30 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
README.md
View file

@ -438,8 +438,10 @@ job:
ownership handoff for HCP roles/boundaries where applicable. Import the
existing site resources only after a no-replacement plan. Apply-role writes
are limited to ordinary tags, `PutRolePolicy` on the exact deploy role,
`PutBucketPolicy` on the exact bucket, and A/AAAA changes for the exact site
name with CREATE/DELETE/UPSERT conditions.
`PutBucketPolicy` on the exact bucket, `UpdateDistribution` on the exact
distribution, `UpdateFunction` and `PublishFunction` on the exact CloudFront
function, and A/AAAA changes for the exact site name with
CREATE/DELETE/UPSERT conditions.
5. For a future tf-poc, first provision and inventory the site outside these
adoption roles. Set all five `shocFrontendPoc*` identifiers from the
frontend shared creator outputs while its role gate remains false, deploy
@ -451,14 +453,17 @@ job:
a false gate as rollback after CloudFormation owns a role.
The apply roles explicitly deny role lifecycle/trust/boundary/managed-policy
changes, `PassRole`, secret and parameter reads, CloudFront/S3 infrastructure
mutation, and deletion of inline role or bucket policies. IAM does not expose a
condition key for an inline policy name, so `PutRolePolicy` is constrained to
the exact target-role ARN and requires the exact dedicated deploy boundary to
already be attached. The boundary limits effective permissions, and the SCP
requires the target role's locked `HcpTerraformWorkspace` tag to equal the
apply role's principal tag. The Terraform resource must retain the inventoried
inline policy name.
changes, `PassRole`, secret and parameter reads, CloudFront/S3 create and
delete (including OAC mutation), and deletion of inline role or bucket
policies. `UpdateDistribution` is allowed on the exact pinned distribution ARN.
`UpdateFunction` and `PublishFunction` are allowed on the exact pinned function
ARN so Phase 2 ownership tags can apply; create, delete, and OAC updates stay
denied. IAM does not expose a condition key for an inline policy name, so
`PutRolePolicy` is constrained to the exact target-role ARN and requires the
exact dedicated deploy boundary to already be attached. The boundary limits
effective permissions, and the SCP requires the target role's locked
`HcpTerraformWorkspace` tag to equal the apply role's principal tag. The
Terraform resource must retain the inventoried inline policy name.
**HCP Terraform layout (org-level setup, console):** one org `seahaven`
(free tier: 500 managed resources, 1 concurrent run); one HCP **project per

18
lib/terraform-substrate/shoc-frontend-resources.ts
View file

@ -270,9 +270,6 @@ const frontendApplyPolicy = (
"cloudfront:DeleteDistribution",
"cloudfront:DeleteFunction",
"cloudfront:DeleteOriginAccessControl",
"cloudfront:PublishFunction",
"cloudfront:UpdateDistribution",
"cloudfront:UpdateFunction",
"cloudfront:UpdateOriginAccessControl",
"s3:CreateBucket",
"s3:DeleteBucket",
@ -331,6 +328,21 @@ const frontendApplyPolicy = (
functionArn(environment.functionName),
],
},
// TagResource is already allowed. Update* and PublishFunction were denied
// on * so Phase 2 in-place CloudFront updates could not apply. Scope them
// to exact ARNs. The AWS provider publishes after UpdateFunction.
{
Sid: "UpdateExactDistribution",
Effect: "Allow",
Action: "cloudfront:UpdateDistribution",
Resource: distributionArn(environment.distributionId),
},
{
Sid: "UpdateExactFunction",
Effect: "Allow",
Action: ["cloudfront:UpdateFunction", "cloudfront:PublishFunction"],
Resource: functionArn(environment.functionName),
},
{
Sid: "ReplaceExactDeployInlinePolicy",
Effect: "Allow",