Adam Moussa
08191ded4c
chore(iam): finalize backend role ownership ( #132 )
...
Deploy / deploy-management (push) Waiting to run
Deploy / deploy-external-dev (push) Waiting to run
Deploy / deploy-security (push) Waiting to run
Deploy / deploy-dev (push) Waiting to run
Deploy / deploy-prod (push) Waiting to run
* chore(iam): finalize backend role ownership
* fix(iam): complete backend import permissions
2026-08-30 20:12:54 +00:00
Adam Moussa
dba0871587
feat(iam): add external-dev backend Terraform substrate ( #131 )
...
Deploy / deploy-management (push) Waiting to run
Deploy / deploy-external-dev (push) Waiting to run
Deploy / deploy-security (push) Waiting to run
Deploy / deploy-dev (push) Waiting to run
Deploy / deploy-prod (push) Waiting to run
* feat(iam): add external-dev backend terraform substrate
* fix(iam): require boundaries for SHOC policy writes
2026-08-29 21:04:40 +00:00
Adam Moussa
46394f7c75
build(deps): migrate CDK app ts-node->tsx, adopt typescript 7 (INFRA-183) ( #39 )
...
ts-node 10.x is incompatible with the TypeScript 7 compiler API (cdk synth
fails with "Cannot read properties of undefined (reading 'fileExists')").
Switch the cdk.json app runner to tsx (pinned 4.23.0, matching sh-mcp) and
bump typescript to ~7.0.2. Synthesized templates are byte-identical across
all six stacks; toolchain-only change.
2026-07-08 17:48:30 -04:00
Adam Moussa
dc079edb93
Initial account-baseline stack with CloudTrail (audit C-1)
...
Multi-region CloudTrail with log-file validation, a rotating KMS CMK, an
Object-Lock'd S3 log bucket, and CloudWatch Logs delivery. First resident of
the account-level security baseline; AWS Backup / 3-2-1 (C-7) lands alongside.
IAM/KMS/S3 policies cross-reviewed; review caught a missing CloudTrail KMS
grant, now added (SourceArn + encryption-context scoped).
2026-05-29 17:44:55 -04:00
