adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-07 16:08:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(iam): align frontend Terraform substrate

Browse source
This commit is contained in:
Adam Moussa 2026-08-30 22:02:10 -04:00
parent 83cb0a5f9b
commit eeabd85934
3 changed files with 10 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
cdk.json
View file

@ -20,12 +20,12 @@
"@aws-cdk/core:target-partitions": ["aws"],
"enableShocBackendPocRoles": true,
"enableShocBackendLiveRoles": true,
"enableShocFrontendPocRoles": false,
"enableShocFrontendPocRoles": true,
"enableShocFrontendLiveRoles": false,
"shocFrontendPocDistributionId": "",
"shocFrontendPocOriginAccessControlId": "",
"shocFrontendPocFunctionName": "",
"shocFrontendPocHostedZoneId": "",
"shocFrontendPocCertificateArn": ""
"shocFrontendPocDistributionId": "E73KH1SPNFL00",
"shocFrontendPocOriginAccessControlId": "E14MP8Z5YRWO93",
"shocFrontendPocFunctionName": "us-east-1shocfrontendtfpocSpaRewrite4B1A4F5F",
"shocFrontendPocHostedZoneId": "Z10433621DH3UOWM8663D",
"shocFrontendPocCertificateArn": "arn:aws:acm:us-east-1:396287094661:certificate/3dbc8c23-3467-47db-9f6c-39236ca11682"
}
}

6
lib/scp/external-dev-iam-guardrails.json
View file

@ -23,9 +23,7 @@
"Action": ["iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeletePolicy", "iam:DeletePolicyVersion"],
"Resource": [
"arn:aws:iam::396287094661:policy/shoc-backend-*-boundary",
"arn:aws:iam::396287094661:policy/shoc-frontend-new-tf-poc-deploy-boundary",
"arn:aws:iam::396287094661:policy/shoc-frontend-new-dev-deploy-boundary",
"arn:aws:iam::396287094661:policy/shoc-frontend-new-staging-deploy-boundary"
"arn:aws:iam::396287094661:policy/shoc-frontend-new-*-deploy-boundary"
],
"Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
},
@ -68,7 +66,7 @@
"Effect": "Deny",
"Action": ["iam:PutRolePolicy", "iam:TagRole", "iam:UntagRole"],
"Resource": "arn:aws:iam::396287094661:role/githubdeploy-*",
"Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-*", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-tf-poc", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-staging"] } }
"Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-tf-poc", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-staging", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-tf-poc", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-staging"] } }
},
{
"Sid": "DenyUnmanagedGithubRole",

4
lib/terraform-substrate/shoc-frontend-resources.ts
View file

@ -144,7 +144,7 @@ const frontendReadPolicy = (
Sid: "ReadManagedCachePolicy",
Effect: "Allow",
Action: "cloudfront:GetCachePolicy",
Resource: `arn:aws:cloudfront::aws:cache-policy/${CACHE_POLICY_ID}`,
Resource: `arn:aws:cloudfront::${ACCOUNT_ID}:cache-policy/${CACHE_POLICY_ID}`,
},
{
Sid: "ListCachePolicies",
@ -205,7 +205,7 @@ const frontendReadPolicy = (
{
Sid: "FindHostedZone",
Effect: "Allow",
Action: "route53:ListHostedZonesByName",
Action: ["route53:ListHostedZones", "route53:ListHostedZonesByName"],
Resource: "*",
},
{