From 0f84d7808b69ed5de8d1f46cdc4f34d239d50e84 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 13 Aug 2026 16:47:53 -0400 Subject: [PATCH] feat(iam): add per-workload lambda execution boundaries Shared seahaven-lambda-execution-boundary stays unchanged for live roles. New named policies plus an enumerated StringEquals allow-list unblock the next PLAT-71 widen without growing the 6144-character shared document. --- README.md | 68 +- .../deploy-substrate.template.yaml | 644 ++++++++++++++---- .../terraform-substrate.template.yaml | 58 +- 3 files changed, 593 insertions(+), 177 deletions(-) diff --git a/README.md b/README.md index 57c4fdc..4113aa9 100644 --- a/README.md +++ b/README.md @@ -126,8 +126,9 @@ deploy `seahaven-deploy-substrate` into each member account that hosts SAM workloads (currently seahaven-prod and seahaven-dev). It contains the shared account-level deploy plumbing: -- the `seahaven-lambda-execution-boundary` permissions boundary (ceiling for - every SAM-generated Lambda execution role), +- the `seahaven-lambda-execution-boundary` permissions boundary (legacy + shared ceiling for roles not yet retargeted) plus per-workload policies + `seahaven-lambda-execution-boundary-` (PLAT-52), - the `github-cfn-execution-role` CloudFormation execution role that `cd-sam` callers pass as `cfn-role-arn`, - optionally the GitHub OIDC identity provider (`createOidcProvider: true`, @@ -140,17 +141,22 @@ of truth for mgmt (328440206208) until its stacks migrate out. **The two copies are no longer at parity, and the old "edit both files" rule no longer applies uniformly.** Under INFRA-186, `seahaven-lambda-execution-boundary` -in *this* copy was reduced to a fleet-wide floor for prod and dev (where -boundary usage was 0, so no live Lambda could break): CloudWatch Logs write on -`/aws/lambda*`, log-group describe, X-Ray, and ENI lifecycle — nothing else. -Each migrating stack adds its own data-plane statements, derived from its own -template, in its own PR (per-workload boundaries are the INFRA-187 end state). -mgmt's copy keeps the account-wide wildcards pending its own separately -validated rollout across 26 live boundary-carrying roles. So: **the boundary -resource is deliberately divergent**; every *other* substrate resource -(`github-cfn-execution-role`, `seahaven-cfn-exec-iam-management`) is still -expected to change in both files together. The template's provenance header -records which is which — read it before assuming either parity or divergence. +in *this* copy was reduced to a fleet-wide floor for prod and dev; later +migrations packed per-workload data plane back into that shared document until +it hit the 6,144-character cap (PLAT-93 / PLAT-100). PLAT-52 adds per-workload +policies `seahaven-lambda-execution-boundary-` (floor plus that +stack's data plane) and switches both prod/dev guardrails to a StringEquals +allow-list of the shared ARN plus each per-workload ARN. The shared document +is left unchanged until live roles retarget. Mgmt's copy keeps the +account-wide wildcards and a **single-ARN** pin pending its own separately +validated rollout across 26 live boundary-carrying roles (PLAT-51). So: **the +boundary resource is deliberately divergent**, and the guardrail +`iam:PermissionsBoundary` condition **cardinality** is also divergent +(enumerated list here, scalar on mgmt). Do not weaken mgmt to ArnLike. Every +*other* substrate resource (`github-cfn-execution-role`, +`seahaven-cfn-exec-iam-management` Sid/Action/Resource sets) is still expected +to change in both files together. The template's provenance header records +which is which — read it before assuming either parity or divergence. Per-repo `githubdeploy-*` deploy roles are deliberately NOT part of the substrate — they are provisioned per repo at migration/onboarding time @@ -159,7 +165,9 @@ to it. **Escalation controls on `github-cfn-execution-role`.** Every `iam:CreateRole`, `AttachRolePolicy` and `PutRolePolicy` is conditioned on the target carrying -`seahaven-lambda-execution-boundary`. That condition alone is not sufficient, +one of the enumerated `seahaven-lambda-execution-boundary` ARNs (the shared +policy plus each `seahaven-lambda-execution-boundary-`). That +condition alone is not sufficient, so the attached `seahaven-cfn-exec-iam-management` managed policy also carries three explicit Deny statements: @@ -214,9 +222,10 @@ shared account-level plumbing: `aws.workload.identity`; Retain — it is the federation anchor for every future `hcptf-*` role), - the `seahaven-hcptf-iam-management` guardrail policy: the boundary-gated - IAM role lifecycle (conditioned on `seahaven-lambda-execution-boundary`, - owned by the deploy-substrate stack — hence the explicit stack dependency - in `bin/app.ts`) plus the `DenyBoundaryTampering` / `DenyBoundaryPolicyEdit` + IAM role lifecycle (conditioned on the enumerated + `seahaven-lambda-execution-boundary` allow-list owned by the + deploy-substrate stack — hence the explicit stack dependency in + `bin/app.ts`) plus the `DenyBoundaryTampering` / `DenyBoundaryPolicyEdit` / `DenySelfMutation` backstops. **This policy derives from `seahaven-cfn-exec-iam-management` but is @@ -281,14 +290,16 @@ this template rather than inventing new IAM shapes. (or `:apply`). Exact `StringEquals` only — never `StringLike`, never a wildcarded `run_phase` (a speculative PR plan must never hold write credentials). **If the stack creates Lambda execution roles, this same PR - must also widen `seahaven-lambda-execution-boundary`** per the WIDENING - PATH in `lib/deploy-substrate/deploy-substrate.template.yaml` with the - **exact** secret ARNs from step 1 (no `secret:afi-*` patterns): the - guardrail forces every Terraform-created role to carry that boundary, and - it is a fleet-wide floor with zero data-plane permissions until widened — - an unwidened migration deploys green, then every data-plane call is denied + must also add `seahaven-lambda-execution-boundary-`** per the + WIDENING PATH in `lib/deploy-substrate/deploy-substrate.template.yaml` + (floor plus that stack's data plane, **exact** secret ARNs from step 1, + no `secret:afi-*` patterns) **and** append that policy's ARN to both + guardrail StringEquals allow-lists. Do not add data-plane to the shared + `seahaven-lambda-execution-boundary` document. The guardrail forces every + Terraform-created role to carry a listed boundary; an unlisted or + floor-only boundary deploys green, then every data-plane call is denied at first invoke and async/DLQ writes are discarded silently. IAM roles and - boundary widenings = mandatory cross-family review + + boundary policies = mandatory cross-family review + `/sh-security-review` on the diff. 3a. **Plan role (required for every stack):** attach @@ -321,8 +332,9 @@ this template rather than inventing new IAM shapes. `list-attached-role-policies`; trust subs match the live org/project/workspace names byte-for-byte; simulate the apply role against a `hcptf-*` ARN (expect `explicitDeny` from `DenySelfMutation`) and against - a normal stack role name (expect `allowed`); and if step 3 widened the - boundary, confirm the deployed default version carries the stack's + a normal stack role name (expect `allowed`); and if step 3 added a + per-workload boundary, confirm the deployed default version of + `seahaven-lambda-execution-boundary-` carries the stack's data-plane statements (`aws iam get-policy-version`) — role verification alone never checks boundary content. Mechanical template↔deployed policy reconcile as for other substrate policies. @@ -332,7 +344,9 @@ this template rather than inventing new IAM shapes. trust is pinned per workspace, so a shared set breaks every other workspace. Auto-apply stays OFF until the stack is sealed. 6. **App Terraform PR:** every `aws_iam_role` sets `path = "/tf-managed/"` and - the boundary; package Lambda/layer zips via an account artifact S3 bucket + `permissions_boundary` to that stack's + `seahaven-lambda-execution-boundary-` ARN (not the shared name, + once the per-workload policy exists); package Lambda/layer zips via an account artifact S3 bucket and `aws_s3_object` `content_base64` (HCP plan and apply run on separate workers and do not share local `archive_file` paths — see `afi-backup-monitor/terraform/artifacts.tf`); functions `depends_on` their diff --git a/lib/deploy-substrate/deploy-substrate.template.yaml b/lib/deploy-substrate/deploy-substrate.template.yaml index fc97b8e..f5723ed 100644 --- a/lib/deploy-substrate/deploy-substrate.template.yaml +++ b/lib/deploy-substrate/deploy-substrate.template.yaml @@ -41,13 +41,19 @@ Description: >- # DenyBoundaryPolicyEdit scope were then ported back here, so the two # copies' GUARDRAIL statement sets were reconciled as of that date. # SamCfnIamManagementPolicy and SamCfnExecutionRole remain at parity on -# their IAM STATEMENT SETS across the two files and MUST still be changed -# together. Parity covers statements, not surrounding comments — a comment -# may diverge where it describes boundary content, which now differs -# between the files. The only functional delta -# between them is the DependsOn line above, which is ordering, not -# permission. LambdaExecutionBoundary is NO LONGER byte-identical — see -# DELIBERATE DIVERGENCE below. +# their IAM STATEMENT SETS across the two files EXCEPT the +# iam:PermissionsBoundary StringEquals VALUE. Prod/dev (this file) now +# enumerates the shared ARN plus each seahaven-lambda-execution-boundary- +# ARN (PLAT-52). Mgmt's .github copy keeps the unsuffixed single ARN — +# those per-workload policies do not exist in mgmt, and adding them to +# mgmt's allow-list would be a no-op that reads as false parity. Do not +# weaken mgmt to ArnLike. Sid names, Deny statements, and every other +# Action/Resource still change in both files together. Parity covers +# statements, not surrounding comments — a comment may diverge where it +# describes boundary content, which now differs between the files. The +# only other functional delta is the DependsOn line above, which is +# ordering, not permission. LambdaExecutionBoundary is NO LONGER +# byte-identical — see DELIBERATE DIVERGENCE below. # # DELIBERATE DIVERGENCE — LambdaExecutionBoundary (INFRA-186, 2026-07-30) # The parity rule above is SCOPED, not global. LambdaExecutionBoundary in THIS @@ -108,38 +114,51 @@ Description: >- # ready to roll back — and is explicitly OUT OF SCOPE of INFRA-186. Until that # lands, the two copies stay divergent and that is the intended state. # -# COUPLING: the boundary's ManagedPolicyName and ARN are UNCHANGED and must stay -# unchanged. Four Conditions in SamCfnIamManagementPolicy below, and four more in -# HcptfIamManagementPolicy in lib/terraform-substrate/terraform-substrate.template.yaml, -# pin arn:aws:iam:::policy/seahaven-lambda-execution-boundary by literal -# string inside StringEquals iam:PermissionsBoundary. A rename fails SILENTLY — an -# IAM condition naming a non-existent policy simply never matches, so the -# escalation control would evaporate rather than error — and would additionally -# force a CloudFormation REPLACEMENT that any role carrying the boundary would -# block. INFRA-186 is a CONTENT-ONLY change for exactly this reason; -# terraform-substrate.template.yaml already records that expectation and is -# correctly left untouched. +# COUPLING (PLAT-52): the SHARED policy's ManagedPolicyName and ARN +# (seahaven-lambda-execution-boundary) stay unchanged until +# PermissionsBoundaryUsageCount is 0 in the account. Four Conditions in +# SamCfnIamManagementPolicy below, and four more in HcptfIamManagementPolicy +# in lib/terraform-substrate/terraform-substrate.template.yaml, pin an +# enumerated StringEquals list of acceptable boundary ARNs: the shared ARN +# plus each seahaven-lambda-execution-boundary- ARN. The two files' +# lists MUST match (mechanical sorted-JSON compare). A rename of the SHARED +# policy still fails SILENTLY — an IAM condition naming a non-existent policy +# simply never matches, so the escalation control evaporates rather than +# error — and would additionally force a CloudFormation REPLACEMENT that any +# role carrying the boundary would block. Adding a workload is a NEW named +# ManagedPolicy in this file AND one ARN appended to both allow-lists. Do +# not use ArnLike on seahaven-lambda-execution-boundary-*: githubdeploy-seahaven-org-baseline +# can CreatePolicy via CFN, so a conforming-name policy would become an +# acceptable ceiling without touching the eight pin sites. # # SIZE BUDGET: an attached managed policy document is capped at 6,144 characters -# (whitespace excluded). LambdaExecutionBoundary measures 5986 characters across -# 15 statements as of 2026-08-10 (PLAT-100: MealOrderManagerSsm+LambdaInvoke -# consolidated with execute-api:Invoke; SES kept separate because Resource:"*" -# must not share a statement with execute-api:Invoke. Was 5903/16 after PLAT-93). -# Measure before widening — len(json.dumps(doc, separators=(',',':'))) on the -# synthesized PolicyDocument with ${AWS::AccountId} resolved, and UPDATE THESE -# TWO NUMBERS in the same edit. +# (whitespace excluded). Measure with len(json.dumps(doc, separators=(',',':'))) +# on the synthesized PolicyDocument with ${AWS::AccountId} resolved, and UPDATE +# THE NUMBERS in the same edit. # -# Headroom is 158 characters. Statement consolidation (shared WorkloadSecrets / -# WorkloadDynamoDB / extended WorkloadS3 Resource lists; no new action wildcards) -# is the only remaining lever short of per-workload boundaries. If the budget -# tightens again, the end-state fix is per-workload boundaries -# (seahaven-lambda-execution-boundary-), which also resolves the -# shared-ceiling residual — tracked as PLAT-52 / INFRA-187, do not improvise it. -# CRITICAL: unlike the 2026-07-27 inline-limit incident, -# there is NO restructure available when this cap is reached — a role has exactly -# ONE permissions boundary, so statements cannot be spilled into a second attached -# managed policy. At the cap the only levers are prefix consolidation and dropping -# unused actions. Do not introduce dynamodb:* / s3:* / ses:Send* to reclaim space. +# Shared LambdaExecutionBoundary (legacy ceiling; do not widen): 5986 +# characters / 15 statements as of 2026-08-10 (PLAT-100). Headroom 158. +# Leave it unchanged until live roles retarget (PLAT-52 phase 2). +# +# Per-workload policies (floor + own data plane). Compact sizes recorded +# after synth (prod, ${AWS::AccountId}=011934824531): +# seahaven-lambda-execution-boundary-afi-backup-monitor: 952 / 5 statements +# seahaven-lambda-execution-boundary-front-integrations: 1532 / 6 statements +# seahaven-lambda-execution-boundary-procurement-ingest: 3977 / 11 statements +# seahaven-lambda-execution-boundary-meal-order-manager: 2380 / 10 statements +# seahaven-lambda-execution-boundary-seahaven-site: 1159 / 6 statements +# Dev copies are floor-only (691 / 4) via IsProdAccount. +# +# Guardrail PolicyDocuments also cap at 6,144. Each extra allow-list ARN +# is copied into four Sids in EACH of SamCfnIamManagementPolicy and +# HcptfIamManagementPolicy. Measured after this list (6 ARNs): +# seahaven-cfn-exec-iam-management: 4571 / 10 statements (1573 headroom) +# seahaven-hcptf-iam-management: 4693 / 10 statements (1451 headroom) +# +# CRITICAL: a role has exactly ONE permissions boundary, so statements cannot +# be spilled into a second attached managed policy. Do not introduce +# dynamodb:* / s3:* / ses:Send* to reclaim space. Do not add new data-plane +# to the shared document; create seahaven-lambda-execution-boundary-. # # This template is deployed via lib/deploy-substrate-stack.ts # (cloudformation-include) as stack seahaven-deploy-substrate, once per member @@ -192,32 +211,22 @@ Resources: # intersection of the role's own policies and this boundary, so a misconfigured # SAM role can never exceed what is listed here. # - # SCOPING RULE (INFRA-186, 2026-07-30). This boundary is the FLEET-WIDE FLOOR - # ONLY: what every Lambda execution role needs regardless of workload. It - # carries NO per-workload data-plane statements — each migrating stack adds its - # own, from its own template, in its own PR (see the note on the boundary - # resource and the WIDENING PATH below). It was previously a deliberate SUPERSET - # with account-wide wildcards (table/*, secret:*, sqs :*, function:*, - # parameter/*, and an s3:::*- pattern that was a name-suffix filter, - # not an ownership check). That trade-off was made when the only account - # carrying this policy hosted nothing but the five SAM stacks. It does not - # survive multi-tenancy: seahaven-prod now hosts CDK-owned tenants - # (proposal-system, procurement-ingest, workorder-ingest) whose tables, buckets, - # secrets and queues those wildcards reached, and whose Lambdas carry NO - # permissions boundary at all — making function:* a boundary-escape primitive. - # - # Tightening here carries ZERO runtime risk and was sequenced deliberately: - # PermissionsBoundaryUsageCount is 0 in BOTH accounts this template deploys to - # (seahaven-prod 011934824531 and seahaven-dev 710827005802, verified - # 2026-07-30), so no live Lambda can break. A boundary that is slightly TOO - # TIGHT is recoverable here — the migrating stack widens it in its own PR before - # its first deploy — whereas leaving it loose perpetuates the exposure. Prefer - # tighter; the widening path is below. + # SCOPING RULE (PLAT-52 phase 1, 2026-08-13). New workloads get their own + # ManagedPolicy seahaven-lambda-execution-boundary-: the fleet-wide + # floor (CloudWatchLogsWrite / CloudWatchLogsDescribe / XRay / Ec2Eni) plus + # that workload's data plane, derived from ITS OWN template. Do not add new + # data-plane statements to the shared seahaven-lambda-execution-boundary + # document — it is the legacy ceiling for roles not yet retargeted and stays + # unchanged until PermissionsBoundaryUsageCount is 0. INFRA-186 reduced this + # copy to a floor and later migrations packed data plane back into it under + # the 6,144-character cap (PLAT-93 / PLAT-100). Per-workload policies are + # the escape hatch from that cap and from the shared-ceiling residual. # # A resource pattern that genuinely CANNOT be scoped keeps its wildcard WITH a # written justification on the statement: CloudWatchLogsDescribe, XRay and # Ec2Eni name runtime-created resources or use actions AWS authorises against - # "*" regardless of the ARN supplied. Do not "tighten" those. + # "*" regardless of the ARN supplied. Do not "tighten" those. Copy them into + # every per-workload policy (a role takes exactly one boundary). # # Every "verified " annotation in this file is a POINT-IN-TIME # observation, not live state. Re-validate (usage counts, log-group CMK state, @@ -225,20 +234,22 @@ Resources: # future change. # # WIDENING PATH — read this before migrating a stack into prod or dev. - # The boundary is never widened by the person who hits the AccessDenied. It is - # widened by the migrating stack's owner, in THIS repo, BEFORE the workload's + # The ceiling is never widened by the person who hits the AccessDenied. It is + # created by the migrating stack's owner, in THIS repo, BEFORE the workload's # first deploy into the target account: - # 0. PRECONDITION — check the managed-policy VERSION budget BEFORE merging: - # max 5 versions, both - # accounts are on v1 today. Every widening (PolicyDocument edit) burns - # one. Description, ManagedPolicyName and Path are REPLACEMENT - # properties per the CFN resource reference — CloudFormation cannot - # replace a custom-named policy, so a Description-only edit FAILS the - # stack update, and the error's suggested remedy (rename) is exactly - # the forbidden rename in the COUPLING note above. Never edit those - # three properties. Delete the oldest non-default version if at 5: + # 0. Create AWS::IAM::ManagedPolicy seahaven-lambda-execution-boundary- + # in this file (floor via the YAML anchors on AfiBackupMonitorBoundary, + # plus that stack's data plane). Do NOT edit the shared + # LambdaExecutionBoundary PolicyDocument. Description, ManagedPolicyName + # and Path on an existing named policy are REPLACEMENT properties — + # CloudFormation cannot replace a custom-named policy, so a + # Description-only edit FAILS the stack update, and the error's suggested + # remedy (rename) is the forbidden rename in the COUPLING note. Never + # edit those three properties on a policy that already exists. New + # policies start at v1. Per-policy version budget (max 5) applies when + # later editing that workload's document: # aws iam list-policy-versions --policy-arn \ - # arn:aws:iam:::policy/seahaven-lambda-execution-boundary + # arn:aws:iam:::policy/seahaven-lambda-execution-boundary- # aws iam delete-policy-version --version-id v ... # 1. Derive the workload's needs from ITS OWN TEMPLATE — open the stack's # template.yaml and read the actual IAM policy statements. The @@ -246,29 +257,34 @@ Resources: # the /sh-security-review pass on 2026-07-30 found SIX places where it was # incomplete or simply invented a resource name, three of which would have # failed silently. Update that block in the same edit with what you find. - # 2. Add the workload's statements. Group by service so a second workload can - # extend a Resource list rather than duplicate an action list (~250 - # characters for zero new actions; an extra ARN costs ~60). Check for the - # SILENT classes specifically: a denied SQS destination/DLQ write discards - # the async event with no error and no alarm; a denied scheduler call may - # sit behind a bare except; a denied KMS decrypt for env-var encryption - # fails at cold-start INIT; any CMK-encrypted resource needs the - # matching kms:ViaService principal, not just the kms action; and a - # function using LoggingConfig with a custom log-group name outside - # /aws/lambda* silently loses ALL logs — add a scoped logs statement - # for the custom group or keep the default group name. - # 3. Measure. See SIZE BUDGET in the header. There is NO escape hatch. - # 4. Both review gates run and neither discharges the other: the GPT-4.1 - # cross-family review against the real diff, and /sh-security-review + # 2. Add the workload's statements to ITS policy. Do not pack them into + # another workload's Resource lists. Check for the SILENT classes: + # a denied SQS destination/DLQ write discards the async event with no + # error and no alarm; a denied scheduler call may sit behind a bare + # except; a denied KMS decrypt for env-var encryption fails at cold-start + # INIT; any CMK-encrypted resource needs the matching kms:ViaService + # principal, not just the kms action; and a function using LoggingConfig + # with a custom log-group name outside /aws/lambda* silently loses ALL + # logs — add a scoped logs statement for the custom group or keep the + # default group name. + # 3. Measure THAT policy against 6144 (SIZE BUDGET). Also measure both + # guardrail PolicyDocuments after step 4 — each new ARN is copied into + # four Sids in each guardrail. + # 4. Append the new ARN to BOTH allow-lists (SamCfnIamManagementPolicy in + # this file AND HcptfIamManagementPolicy in + # terraform-substrate.template.yaml). The lists must match. Do not use + # ArnLike. Both review gates run and neither discharges the other: the + # GPT-4.1 cross-family review against the real diff, and /sh-security-review # (IaC/IAM is on the mandatory surface). CLI down = review outstanding. - # 5. Merge and let CI deploy deploy-substrate-prod / deploy-substrate-dev to - # UPDATE_COMPLETE, THEN deploy the workload stack. + # 5. Merge and let CI deploy deploy-substrate-prod / deploy-substrate-dev + # (and terraform-substrate) to UPDATE_COMPLETE, THEN deploy the workload + # with PermissionsBoundary set to THIS stack's ARN (not the shared name). # ORDERING IS NOT ENFORCED BY CLOUDFORMATION AND THIS IS THE MOST IMPORTANT - # SENTENCE HERE: the workload's deploy SUCCEEDS even against a stale boundary, - # because seahaven-cfn-exec-iam-management's gate checks that the boundary ARN - # is attached, never its contents. The failure surfaces later, at first invoke, - # as AccessDenied. A stale boundary is a silent deploy-time pass and a loud - # production failure. + # SENTENCE HERE: the workload's deploy SUCCEEDS even against a stale or + # missing-content boundary, because the guardrail gates check that a listed + # boundary ARN is attached, never its contents. The failure surfaces later, + # at first invoke, as AccessDenied. A stale boundary is a silent deploy-time + # pass and a loud production failure. # # CONSIDERED AND REJECTED: a Deny statement reserving the seahaven-* namespace. # With the Allow set reduced to the fleet-wide floor it is fully redundant (verified @@ -705,28 +721,397 @@ Resources: Resource: "*" - !Ref AWS::NoValue - # ── FURTHER PER-WORKLOAD DATA-PLANE STATEMENTS ────────────────────── - # Floor above + consolidated WorkloadSecrets/DynamoDB/S3 (PLAT-93) + - # procurement remainder + seahaven-site (PLAT-91) + meal-order extras - # (PLAT-70). Prefer extending existing Resource lists over new SIDs. - # Additional stacks add statements here, derived from THEIR OWN - # template, in their own PR, deployed to UPDATE_COMPLETE before first - # workload deploy. Measure SIZE BUDGET before merging. WIDENING PATH - # in the header still governs. - # - # WHY the floor stayed empty of data-plane (decided 2026-07-30, Adam): - # The security win of INFRA-186 comes from DELETION, not enumeration. - # Removing the account-wide secret:*, table/*, function:* and sqs:* - # wildcards is what closes the amplifier. Per-workload prefixes add no - # security; they exist only to keep a workload FUNCTIONAL once it - # arrives. WIDENING IS THE SAFE DIRECTION. - # - # The end-state fix for the shared-ceiling residual (one boundary = - # every SAM/Terraform workload reaches every other's data plane once - # they land) is per-workload boundaries — tracked as PLAT-52 / - # INFRA-187. Do not improvise it: both guardrail policies pin ONE - # literal boundary ARN inside StringEquals conditions, and loosening - # that to a wildcard weakens the gate. + # ── FURTHER PER-WORKLOAD DATA-PLANE ──────────────────────────────── + # Do not add statements here. Create seahaven-lambda-execution-boundary- + # below and append its ARN to both guardrail allow-lists (WIDENING PATH). + # This shared document stays unchanged until live roles retarget + # (PLAT-52 phase 2) and PermissionsBoundaryUsageCount reaches 0. + # --------------------------------------------------------------------------- + # Per-workload Lambda execution boundaries (PLAT-52 phase 1) + # + # Each policy is the fleet floor plus that workload's data plane, split from + # the shared document above without editing it. Live roles keep the shared + # ARN until app-repo retargets. Guardrail StringEquals lists include both. + # Floor statements are YAML-anchored on AfiBackupMonitorBoundary; later + # policies alias them. Floor rationale lives on LambdaExecutionBoundary. + # Prod-only data plane stays behind IsProdAccount (same as the shared copy). + # --------------------------------------------------------------------------- + AfiBackupMonitorBoundary: + Type: AWS::IAM::ManagedPolicy + Properties: + ManagedPolicyName: seahaven-lambda-execution-boundary-afi-backup-monitor + Description: >- + Per-workload permissions boundary for afi-backup-monitor (PLAT-52). + Floor plus exact prod secret ARNs. Shared seahaven-lambda-execution-boundary + remains the live-role ceiling until app retarget. + PolicyDocument: + Version: "2012-10-17" + Statement: + - &lambdaBoundaryFloorLogsWrite + Sid: CloudWatchLogsWrite + Effect: Allow + Action: + - logs:CreateLogGroup + - logs:CreateLogStream + - logs:PutLogEvents + - logs:DescribeLogStreams + Resource: + - !Sub "arn:aws:logs:us-east-1:${AWS::AccountId}:log-group:/aws/lambda*" + - &lambdaBoundaryFloorLogsDescribe + Sid: CloudWatchLogsDescribe + Effect: Allow + Action: + - logs:DescribeLogGroups + Resource: "*" + - &lambdaBoundaryFloorXRay + Sid: XRay + Effect: Allow + Action: + - xray:PutTraceSegments + - xray:PutTelemetryRecords + Resource: "*" + - &lambdaBoundaryFloorEc2Eni + Sid: Ec2Eni + Effect: Allow + Action: + - ec2:CreateNetworkInterface + - ec2:DescribeNetworkInterfaces + - ec2:DeleteNetworkInterface + - ec2:DescribeSubnets + - ec2:DescribeSecurityGroups + - ec2:DescribeVpcs + Resource: "*" + - !If + - IsProdAccount + - Sid: AfiBackupMonitorSecrets + Effect: Allow + Action: + - secretsmanager:GetSecretValue + Resource: + - arn:aws:secretsmanager:us-east-1:011934824531:secret:afi-api-key-w0E02a + - arn:aws:secretsmanager:us-east-1:011934824531:secret:afi-slack-webhook-T4oR3G + - !Ref AWS::NoValue + + FrontIntegrationsBoundary: + Type: AWS::IAM::ManagedPolicy + Properties: + ManagedPolicyName: seahaven-lambda-execution-boundary-front-integrations + Description: >- + Per-workload permissions boundary for front-integrations (PLAT-52). + Floor plus exact prod secrets and front-sla-alerts. Shared policy + remains the live-role ceiling until app retarget. + PolicyDocument: + Version: "2012-10-17" + Statement: + # Floor aliases — edit the &lambdaBoundaryFloor* anchors on + # AfiBackupMonitorBoundary only; do not inline a divergent copy. + - *lambdaBoundaryFloorLogsWrite + - *lambdaBoundaryFloorLogsDescribe + - *lambdaBoundaryFloorXRay + - *lambdaBoundaryFloorEc2Eni + - !If + - IsProdAccount + - Sid: FrontIntegrationsSecrets + Effect: Allow + Action: + - secretsmanager:GetSecretValue + Resource: + - arn:aws:secretsmanager:us-east-1:011934824531:secret:front-integrations/front-api-token-UXKv0U + - arn:aws:secretsmanager:us-east-1:011934824531:secret:front-integrations/slack-bot-token-giGfA7 + - arn:aws:secretsmanager:us-east-1:011934824531:secret:front-integrations/google-service-account-dqv3Bo + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: FrontIntegrationsDynamoDB + Effect: Allow + Action: + - dynamodb:GetItem + - dynamodb:PutItem + - dynamodb:UpdateItem + - dynamodb:DeleteItem + - dynamodb:Query + - dynamodb:Scan + - dynamodb:BatchGetItem + - dynamodb:BatchWriteItem + - dynamodb:DescribeTable + - dynamodb:ConditionCheckItem + Resource: + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/front-sla-alerts" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/front-sla-alerts/index/*" + - !Ref AWS::NoValue + + ProcurementIngestBoundary: + Type: AWS::IAM::ManagedPolicy + Properties: + ManagedPolicyName: seahaven-lambda-execution-boundary-procurement-ingest + Description: >- + Per-workload permissions boundary for procurement-ingest including + bundled workorder-ingest data plane (PLAT-86 grouping, PLAT-52 split). + Shared policy remains the live-role ceiling until app retarget. + PolicyDocument: + Version: "2012-10-17" + Statement: + # Floor aliases — edit the &lambdaBoundaryFloor* anchors on + # AfiBackupMonitorBoundary only; do not inline a divergent copy. + - *lambdaBoundaryFloorLogsWrite + - *lambdaBoundaryFloorLogsDescribe + - *lambdaBoundaryFloorXRay + - *lambdaBoundaryFloorEc2Eni + - !If + - IsProdAccount + - Sid: ProcurementIngestSecrets + Effect: Allow + Action: + - secretsmanager:GetSecretValue + Resource: + - arn:aws:secretsmanager:us-east-1:011934824531:secret:procurement-ingest/web-ui-auth-token-ApAMmr + - arn:aws:secretsmanager:us-east-1:011934824531:secret:workorder-ingest/shoc-webhook-hmac-puYTcB + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: ProcurementIngestDynamoDB + Effect: Allow + Action: + - dynamodb:GetItem + - dynamodb:PutItem + - dynamodb:UpdateItem + - dynamodb:DeleteItem + - dynamodb:Query + - dynamodb:Scan + - dynamodb:BatchGetItem + - dynamodb:BatchWriteItem + - dynamodb:DescribeTable + - dynamodb:ConditionCheckItem + - dynamodb:GetRecords + - dynamodb:GetShardIterator + - dynamodb:DescribeStream + Resource: + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/purchase-orders" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/purchase-orders/*" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/verified-sites" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/verified-sites/*" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/pending-site-review" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/pending-site-review/*" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrders" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrders/*" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments/*" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders/*" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments/*" + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: ProcurementIngestS3 + Effect: Allow + Action: + - s3:GetObject* + - s3:GetBucket* + - s3:List* + - s3:PutObject* + - s3:DeleteObject* + - s3:AbortMultipartUpload + Resource: + - !Sub "arn:aws:s3:::po-ingest-emails-${AWS::AccountId}" + - !Sub "arn:aws:s3:::po-ingest-emails-${AWS::AccountId}/*" + - !Sub "arn:aws:s3:::workorder-ingest-emails-${AWS::AccountId}" + - !Sub "arn:aws:s3:::workorder-ingest-emails-${AWS::AccountId}/*" + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: ProcurementIngestSqs + Effect: Allow + Action: + - sqs:SendMessage + - sqs:ReceiveMessage + - sqs:DeleteMessage + - sqs:GetQueueAttributes + - sqs:GetQueueUrl + - sqs:ChangeMessageVisibility + Resource: + - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:po-ingest-*" + - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:WorkorderIngestStack-*" + - !Sub "arn:aws:sqs:us-east-1:${AWS::AccountId}:workorder-shoc-emitter-*" + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: ProcurementIngestKms + Effect: Allow + Action: + - kms:Decrypt + - kms:DescribeKey + - kms:Encrypt + - kms:GenerateDataKey* + - kms:ReEncrypt* + Resource: + - arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12 + - arn:aws:kms:us-east-1:011934824531:key/d10fd1f0-a61a-4405-8568-85e9fd11ba18 + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: ProcurementIngestBedrock + Effect: Allow + Action: + - bedrock:InvokeModel + - bedrock:InvokeModelWithResponseStream + Resource: + - !Sub "arn:aws:bedrock:us-east-1:${AWS::AccountId}:inference-profile/us.anthropic.claude-haiku-4-5-20251001-v1:0" + - arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0 + - arn:aws:bedrock:us-east-2::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0 + - arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-haiku-4-5-20251001-v1:0 + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: ProcurementIngestSns + Effect: Allow + Action: + - sns:Publish + Resource: + - !Sub "arn:aws:sns:us-east-1:${AWS::AccountId}:site-alerts" + - !Ref AWS::NoValue + + MealOrderManagerBoundary: + Type: AWS::IAM::ManagedPolicy + Properties: + ManagedPolicyName: seahaven-lambda-execution-boundary-meal-order-manager + Description: >- + Per-workload permissions boundary for meal-order-manager (PLAT-52). + Floor plus secrets, orders table, form/reports buckets, site-alerts, + SSM/invoke/execute-api, and SES. Shared policy remains the live-role + ceiling until app retarget. + PolicyDocument: + Version: "2012-10-17" + Statement: + # Floor aliases — edit the &lambdaBoundaryFloor* anchors on + # AfiBackupMonitorBoundary only; do not inline a divergent copy. + - *lambdaBoundaryFloorLogsWrite + - *lambdaBoundaryFloorLogsDescribe + - *lambdaBoundaryFloorXRay + - *lambdaBoundaryFloorEc2Eni + - !If + - IsProdAccount + - Sid: MealOrderManagerSecrets + Effect: Allow + Action: + - secretsmanager:GetSecretValue + Resource: + - arn:aws:secretsmanager:us-east-1:011934824531:secret:meal-order-manager/slack-bot-token-ZGmSGw + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: MealOrderManagerDynamoDB + Effect: Allow + Action: + - dynamodb:GetItem + - dynamodb:PutItem + - dynamodb:UpdateItem + - dynamodb:DeleteItem + - dynamodb:Query + - dynamodb:Scan + - dynamodb:BatchGetItem + - dynamodb:BatchWriteItem + - dynamodb:DescribeTable + - dynamodb:ConditionCheckItem + Resource: + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/meal-order-manager-orders" + - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/meal-order-manager-orders/index/*" + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: MealOrderManagerS3 + Effect: Allow + Action: + - s3:GetObject* + - s3:GetBucket* + - s3:List* + - s3:PutObject* + - s3:DeleteObject* + - s3:AbortMultipartUpload + Resource: + - !Sub "arn:aws:s3:::meal-order-manager-form-${AWS::AccountId}" + - !Sub "arn:aws:s3:::meal-order-manager-form-${AWS::AccountId}/*" + - !Sub "arn:aws:s3:::meal-order-manager-reports-${AWS::AccountId}" + - !Sub "arn:aws:s3:::meal-order-manager-reports-${AWS::AccountId}/*" + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: MealOrderManagerSns + Effect: Allow + Action: + - sns:Publish + Resource: + - !Sub "arn:aws:sns:us-east-1:${AWS::AccountId}:site-alerts" + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: MealOrderManager + Effect: Allow + Action: + - ssm:GetParameter + - lambda:InvokeFunction + - execute-api:Invoke + Resource: + - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*" + - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:meal-order-manager-*" + - !Sub "arn:aws:execute-api:us-east-1:${AWS::AccountId}:*/*/GET/api/publish/settings" + - !Sub "arn:aws:execute-api:us-east-1:${AWS::AccountId}:*/*/POST/api/publish/menu" + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: MealOrderManagerSes + Effect: Allow + Action: + - ses:SendRawEmail + Resource: "*" + - !Ref AWS::NoValue + + SeahavenSiteBoundary: + Type: AWS::IAM::ManagedPolicy + Properties: + ManagedPolicyName: seahaven-lambda-execution-boundary-seahaven-site + Description: >- + Per-workload permissions boundary for githubdeploy-seahaven-site + (PLAT-91 / PLAT-52). Floor plus origin S3 and CloudFront invalidate. + Not a Lambda; hcptf guardrail still requires a listed boundary on + /tf-managed/ roles. Shared policy remains the live-role ceiling + until app retarget. + PolicyDocument: + Version: "2012-10-17" + Statement: + # Floor aliases — edit the &lambdaBoundaryFloor* anchors on + # AfiBackupMonitorBoundary only; do not inline a divergent copy. + - *lambdaBoundaryFloorLogsWrite + - *lambdaBoundaryFloorLogsDescribe + - *lambdaBoundaryFloorXRay + - *lambdaBoundaryFloorEc2Eni + - !If + - IsProdAccount + - Sid: SeahavenSiteOriginS3 + Effect: Allow + Action: + - s3:GetObject + - s3:PutObject + - s3:DeleteObject + - s3:GetObjectTagging + - s3:PutObjectTagging + - s3:ListBucket + - s3:GetBucketLocation + Resource: + - arn:aws:s3:::seahaven-site-prod + - arn:aws:s3:::seahaven-site-prod/* + - !Ref AWS::NoValue + - !If + - IsProdAccount + - Sid: SeahavenSiteCloudFrontInvalidate + Effect: Allow + Action: + - cloudfront:CreateInvalidation + - cloudfront:GetInvalidation + Resource: + - !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/*" + - !Ref AWS::NoValue + # --------------------------------------------------------------------------- # Shared CloudFormation execution role (SAM stacks) — INFRA-97 scoped # @@ -736,9 +1121,10 @@ Resources: # # PRIMARY ESCALATION CONTROL # iam:CreateRole and iam:AttachRolePolicy / iam:PutRolePolicy are - # conditioned on iam:PermissionsBoundary StringEquals the boundary ARN - # (seahaven-lambda-execution-boundary, created in INFRA-103). That - # condition is what prevents the CFN execution role from minting an + # conditioned on iam:PermissionsBoundary StringEquals an enumerated list + # of acceptable boundary ARNs (shared seahaven-lambda-execution-boundary + # plus each seahaven-lambda-execution-boundary-, PLAT-52). + # That condition is what prevents the CFN execution role from minting an # unconstrained admin role. # # SAM RolePath deviation note @@ -1221,12 +1607,12 @@ Resources: # This is the PRIMARY escalation control for INFRA-97. # # iam:CreateRole / iam:AttachRolePolicy / iam:PutRolePolicy are - # conditioned on iam:PermissionsBoundary StringEquals the - # seahaven-lambda-execution-boundary ARN. That condition means - # any role this execution role creates must have the boundary - # applied, so it can never exceed what the boundary allows (in - # THIS file the fleet-wide floor plus per-migration widenings; - # in mgmt's copy the five SAM stacks' service wildcards). + # conditioned on iam:PermissionsBoundary StringEquals an enumerated + # list: the shared seahaven-lambda-execution-boundary ARN plus each + # seahaven-lambda-execution-boundary- ARN (PLAT-52). That + # condition means any role this execution role creates must have a + # listed boundary applied, so it can never exceed what that boundary + # allows. Mgmt's .github copy still pins the unsuffixed ARN only. # # iam:PassRole is also included here so CloudFormation can pass # the auto-generated Lambda execution role to the Lambda service. @@ -1263,7 +1649,13 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": &acceptableLambdaBoundaries + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-front-integrations" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-procurement-ingest" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-meal-order-manager" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-seahaven-site" # Attach managed policies — MUST have boundary already on role - Sid: IAMAttachPolicyWithBoundary @@ -1274,7 +1666,7 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": *acceptableLambdaBoundaries # Put inline policy — MUST have boundary already on role - Sid: IAMPutRolePolicyWithBoundary @@ -1285,7 +1677,7 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": *acceptableLambdaBoundaries # Boundary management — SET the boundary only. DELETE is NOT # granted: for a delete, the iam:PermissionsBoundary condition key @@ -1307,7 +1699,7 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": *acceptableLambdaBoundaries # Explicit Deny backstop (AWS's documented NoBoundaryPolicyEdit / # NoBoundaryDelete delegation pattern). A Deny is required, not diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml index c73efcf..73333d6 100644 --- a/lib/terraform-substrate/terraform-substrate.template.yaml +++ b/lib/terraform-substrate/terraform-substrate.template.yaml @@ -57,28 +57,32 @@ Description: >- # protection in (4) but is attached ONLY to the security OU — extending it to # prod/nonprod is the durable org-level fix and is tracked separately. # -# COUPLING: the boundary ARN referenced in the Conditions below is -# seahaven-lambda-execution-boundary, created by the seahaven-deploy-substrate -# stack in the same account. The reference is a literal !Sub string inside -# Condition values, so CloudFormation infers NO ordering edge from it — -# bin/app.ts carries an explicit addStackDependency on the same-account -# deploy-substrate stack instead. The coupling is by NAME: if the boundary -# policy is ever renamed or replaced, every Condition below (and the -# deploy-substrate copy) must change in the same piece of work. INFRA-186 -# (boundary reduced to a fleet-wide floor; per-workload boundaries are -# INFRA-187) changed the boundary's CONTENT, not its ARN, so this file is -# textually untouched — but the Terraform path IS affected: the Conditions -# below FORCE every role a Terraform apply creates onto that boundary, and -# the floor carries zero data-plane permissions. A migrating stack that -# creates Lambda execution roles must widen the boundary per the WIDENING -# PATH in lib/deploy-substrate/deploy-substrate.template.yaml, deployed -# before its first apply (README migration checklist step 2). +# COUPLING: acceptable boundary ARNs are an enumerated StringEquals list +# (PLAT-52): seahaven-lambda-execution-boundary plus each +# seahaven-lambda-execution-boundary-. The policies live in +# seahaven-deploy-substrate in the same account. The reference is a literal +# !Sub string inside Condition values, so CloudFormation infers NO ordering +# edge from it — bin/app.ts carries an explicit addStackDependency on the +# same-account deploy-substrate stack instead. The two files' allow-lists +# MUST match (mechanical sorted-JSON compare). Renaming the SHARED policy +# still fails silently. Adding a workload appends one ARN here AND creates +# the named policy in deploy-substrate. Do not use ArnLike on +# seahaven-lambda-execution-boundary-*: the org-baseline deploy role can +# CreatePolicy via CFN. INFRA-186 changed the shared boundary's CONTENT, not +# its ARN. A migrating stack that creates Lambda execution roles must add +# seahaven-lambda-execution-boundary- per the WIDENING PATH in +# lib/deploy-substrate/deploy-substrate.template.yaml, deployed before its +# first apply (README migration checklist step 3). Do not widen the shared +# document. # # SIZE BUDGET: an attached managed policy document is capped at 6,144 -# characters (whitespace excluded). The statement set below is ~2.5 KB. -# Measure before adding statements — len(json.dumps(doc,separators=(',',':'))) -# on the synthesized PolicyDocument — the same wall the role INLINE limit -# (10,240 bytes) put the first deploy-substrate deploy into on 2026-07-27. +# characters (whitespace excluded). The statement set below was ~2.5 KB +# before the PLAT-52 allow-list. Each extra boundary ARN is copied into +# four Sids. Measure before merging — +# len(json.dumps(doc,separators=(',',':'))) on the synthesized PolicyDocument +# — the same wall the role INLINE limit (10,240 bytes) put the first +# deploy-substrate deploy into on 2026-07-27. Compact size recorded after +# synth in this PR: 4693 characters / 10 statements (1451 headroom). # # PER-WORKSPACE ROLE ACCUMULATOR # At each stack's migration, a PR appends to this template: @@ -200,7 +204,13 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": &acceptableLambdaBoundaries + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-front-integrations" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-procurement-ingest" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-meal-order-manager" + - !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary-seahaven-site" # Attach managed policies — MUST have boundary already on role - Sid: IAMAttachPolicyWithBoundary @@ -211,7 +221,7 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": *acceptableLambdaBoundaries # Put inline policy — MUST have boundary already on role - Sid: IAMPutRolePolicyWithBoundary @@ -222,7 +232,7 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": *acceptableLambdaBoundaries # Boundary management — SET only, never DELETE. For a delete, the # iam:PermissionsBoundary condition key resolves to the boundary @@ -245,7 +255,7 @@ Resources: - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/*" Condition: StringEquals: - "iam:PermissionsBoundary": !Sub "arn:aws:iam::${AWS::AccountId}:policy/seahaven-lambda-execution-boundary" + "iam:PermissionsBoundary": *acceptableLambdaBoundaries # Explicit Deny backstop (AWS's NoBoundaryPolicyEdit/NoBoundaryDelete # delegation pattern). A Deny is required, not merely omitting the