mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 11:33:17 +00:00
8cbc98d927
* feat(scp): deny iam changes on role/platform unless the platform principal (PLAT-233) Adds ProtectPlatformPath beside the existing name denies in the prod/nonprod SCP and the security OU copy. New hcptf-bootstrap creates use /platform/. Existing roles are not recreated. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> * fix(scp): use live bootstrap ARNs and close the platform path gaps (PLAT-233) Resolve simulate and printed role ARNs from iam:GetRole so a /platform/ create is not reported as an unpathed role. Deny boundary changes on role/platform/*, and match both Identity Center SSO role ARN shapes. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> * fix(scp): deny platform-path changes in bootstrap simulate (PLAT-233) Add a simulate case for role/platform/hcptf-example and fail when CreateRole, PutRolePolicy, or DeleteRole is allowed. The unpathed hcptf-* import check stays. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| cfn-stack-decommission.sh | ||
| check_hcp_workspace_triggers.py | ||
| check_iam_policies.py | ||
| create-hcptf-bootstrap-roles.sh | ||
| delete-terraform-substrate-prod-dev.sh | ||
| iam-user-delete.sh | ||
| resource-usage-probe.sh | ||
| test_check_hcp_workspace_triggers.py | ||