adam/seahaven-org-baseline

Fork 0

mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-04 21:51:58 +00:00

Commit graph

Author	SHA1	Message	Date
Cursor Agent	e3adfc3cdc	feat(scp): deny iam changes on role/platform unless the platform principal (PLAT-233) Adds ProtectPlatformPath beside the existing name denies in the prod/nonprod SCP and the security OU copy. New hcptf-bootstrap creates use /platform/. Existing roles are not recreated. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>	2026-09-28 00:49:48 +00:00
Adam Moussa	b02f52b805	feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) (#137 ) * feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) * fix(iam): pin HCP boundary ARNs and bootstrap trust window (PLAT-143) Null on iam:PermissionsBoundary accepted any ceiling, including AdministratorAccess. Import apply cannot self-mutate hcptf-* while bootstrap trust is iam-bootstrap only; add a time-boxed exact StringEquals workspace grant instead of StringLike.	2026-09-02 15:22:48 +00:00

Author

SHA1

Message

Date

Cursor Agent

e3adfc3cdc

feat(scp): deny iam changes on role/platform unless the platform principal (PLAT-233)

Adds ProtectPlatformPath beside the existing name denies in the
prod/nonprod SCP and the security OU copy. New hcptf-bootstrap
creates use /platform/. Existing roles are not recreated.

Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>

2026-09-28 00:49:48 +00:00

Adam Moussa

b02f52b805

feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) (#137 )

* feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143)

* fix(iam): pin HCP boundary ARNs and bootstrap trust window (PLAT-143)

Null on iam:PermissionsBoundary accepted any ceiling, including AdministratorAccess. Import apply cannot self-mutate hcptf-* while bootstrap trust is iam-bootstrap only; add a time-boxed exact StringEquals workspace grant instead of StringLike.

2026-09-02 15:22:48 +00:00

2 commits