adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-07 16:08:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(iam): pin door-unlock apigw domain and ssm reads

Browse source 
Stop the apply role from managing every HTTP API custom domain, and keep SecureString door-unlock parameters off HCP plan and apply GetParameter.
This commit is contained in:
Adam Moussa 2026-08-27 17:15:03 -04:00
parent 032e5992dc
commit 502550a9fb
No known key found for this signature in database
1 changed files with 25 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
lib/terraform-substrate/terraform-substrate.template.yaml
View file

@ -2063,11 +2063,18 @@ Resources:
- acm:ListTagsForCertificate
- acm:GetCertificate
Resource: "*"
# String door-id only. SecureString auth-token / elements-api-key
# stay off the plan role so speculative runs cannot render them.
- Sid: RefreshDoorUnlockSsm
Effect: Allow
Action:
- ssm:GetParameter
- ssm:GetParameters
Resource:
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/door-id"
- Sid: RefreshDoorUnlockSsmTags
Effect: Allow
Action:
- ssm:ListTagsForResource
Resource:
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/*"
@ -2082,7 +2089,8 @@ Resources:
- apigateway:GET
Resource:
- !Sub "arn:aws:apigateway:us-east-1::/apis/*"
- !Sub "arn:aws:apigateway:us-east-1::/domainnames/*"
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com/*
- !Sub "arn:aws:apigateway:us-east-1::/tags/*"
- Sid: RefreshAlarms
Effect: Allow
@ -2175,6 +2183,8 @@ Resources:
Resource:
- !Sub "arn:aws:s3:::door-unlock-api-artifacts-${AWS::AccountId}"
- !Sub "arn:aws:s3:::door-unlock-api-artifacts-${AWS::AccountId}/*"
# HTTP API ids are allocated at create (same as meal-order).
# Custom domain is hostname-pinned like procurement-api.
- Sid: HttpApiManage
Effect: Allow
Action:
@ -2182,9 +2192,14 @@ Resources:
Resource:
- !Sub "arn:aws:apigateway:us-east-1::/apis"
- !Sub "arn:aws:apigateway:us-east-1::/apis/*"
- !Sub "arn:aws:apigateway:us-east-1::/domainnames"
- !Sub "arn:aws:apigateway:us-east-1::/domainnames/*"
- !Sub "arn:aws:apigateway:us-east-1::/tags/*"
- Sid: HttpApiDomain
Effect: Allow
Action:
- apigateway:*
Resource:
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com
- arn:aws:apigateway:us-east-1::/domainnames/doorunlock.seahaven.com/*
- Sid: AcmCreate
Effect: Allow
Action:
@ -2212,11 +2227,18 @@ Resources:
Condition:
StringEquals:
"aws:ResourceTag/Project": seahaven-door-unlock-api
# HCP reads the String door-id data source only. Lambda execution
# roles (not this apply role) GetParameter the SecureStrings.
- Sid: DoorUnlockSsm
Effect: Allow
Action:
- ssm:GetParameter
- ssm:GetParameters
Resource:
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/door-id"
- Sid: DoorUnlockSsmTags
Effect: Allow
Action:
- ssm:ListTagsForResource
Resource:
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/door-unlock/*"