adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-03 06:53:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(iam): allow frontend HCP roles to tag the release pointer (PLAT-188)

Browse source 
Terraform aws_s3_object lists object tags on every refresh, so plan and apply need GetObjectTagging and apply needs PutObjectTagging on the exact .release/current key.
This commit is contained in:
Adam Moussa 2026-09-11 13:34:15 -04:00
parent 97b00ad0f4
commit 696e67875e
No known key found for this signature in database
2 changed files with 13 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
README.md
View file

@ -440,7 +440,8 @@ job:
are limited to ordinary tags, `PutRolePolicy` on the exact deploy role,
`PutBucketPolicy` on the exact bucket, `UpdateDistribution` on the exact
distribution, `CreateInvalidation`/`GetInvalidation` on the exact
distribution, `GetObject`/`PutObject` on `.release/current`,
distribution, `GetObject`/`GetObjectTagging`/`PutObject`/`PutObjectTagging`
on `.release/current`,
`UpdateFunction` and `PublishFunction` on the exact CloudFront
function, and A/AAAA changes for the exact site name with
CREATE/DELETE/UPSERT conditions.
@ -459,8 +460,9 @@ changes, `PassRole`, secret and parameter reads, CloudFront/S3 create and
delete (including OAC mutation), and deletion of inline role or bucket
policies. `UpdateDistribution` is allowed on the exact pinned distribution ARN.
`CreateInvalidation` and `GetInvalidation` are allowed on that same ARN so the
Terraform invalidation action can run. `GetObject`/`PutObject` on
`.release/current` lets Terraform own the release pointer. `UpdateFunction` and `PublishFunction` are allowed on the exact pinned function
Terraform invalidation action can run. `GetObject`/`GetObjectTagging`/`PutObject`/`PutObjectTagging` on
`.release/current` lets Terraform own the release pointer, including the
tag list `aws_s3_object` refreshes on every plan. `UpdateFunction` and `PublishFunction` are allowed on the exact pinned function
ARN so Phase 2 ownership tags can apply; create, delete, and OAC updates stay
denied. IAM does not expose a condition key for an inline policy name, so
`PutRolePolicy` is constrained to the exact target-role ARN and requires the

10
lib/terraform-substrate/shoc-frontend-resources.ts
View file

@ -116,7 +116,7 @@ const frontendReadPolicy = (
{
Sid: "ReadReleasePointerObject",
Effect: "Allow",
Action: ["s3:GetObject", "s3:GetObjectVersion"],
Action: ["s3:GetObject", "s3:GetObjectTagging", "s3:GetObjectVersion"],
Resource: `${siteBucketArn}/.release/current`,
},
{
@ -358,7 +358,13 @@ const frontendApplyPolicy = (
{
Sid: "WriteReleasePointerObject",
Effect: "Allow",
Action: ["s3:GetObject", "s3:GetObjectVersion", "s3:PutObject"],
Action: [
"s3:GetObject",
"s3:GetObjectTagging",
"s3:GetObjectVersion",
"s3:PutObject",
"s3:PutObjectTagging",
],
Resource: `${bucketArn(environment.bucketName)}/.release/current`,
},
{