mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 06:53:17 +00:00
960e4619b4
Some checks failed
* fix(iam): allow frontend HCP apply to write deploy SSM and githubdeploy trust (PLAT-212) * fix(iam): grant frontend HCP plan named SSM describe and tag reads (PLAT-212) * fix(iam): allow frontend githubdeploy to read deploy SSM (PLAT-212) HCP apply already writes /shoc-frontend-new/<env>/deploy/*, but the githubdeploy ceiling omitted GetParameter so Deploy Web cannot resolve bucket and distribution after origin moves to the bucket root. * fix(iam): allow staging HCP apply to update the SHOC backend EB stack (PLAT-213) * fix(iam): allow staging HCP apply to use the Elastic Beanstalk bucket (PLAT-213) * fix(iam): allow staging HCP apply to copy the current release zip (PLAT-213) * fix(iam): allow staging HCP apply versioned ACLs on EB env objects (PLAT-213) * fix(iam): give staging HCP apply the proven Elastic Beanstalk bucket grants (PLAT-213) * fix(iam): allow staging HCP apply to write CloudFormation template buckets (PLAT-213) * fix(iam): let staging HCP apply read Elastic Beanstalk service templates (PLAT-213)
84 lines
2.9 KiB
JSON
84 lines
2.9 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "ProtectOtherDeploymentPrincipalTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"NotResource": [
|
|
"arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-dev",
|
|
"arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-staging",
|
|
"arn:aws:iam::396287094661:role/githubdeploy-shoc-frontend-new-dev",
|
|
"arn:aws:iam::396287094661:role/githubdeploy-shoc-frontend-new-staging"
|
|
],
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectShocBackendDevGithubTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"Resource": "arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-dev",
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/hcptf-shoc-backend-dev"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectShocBackendStagingGithubTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"Resource": "arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-staging",
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/hcptf-shoc-backend-staging"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectShocFrontendDevGithubTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"Resource": "arn:aws:iam::396287094661:role/githubdeploy-shoc-frontend-new-dev",
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-dev"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectShocFrontendStagingGithubTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"Resource": "arn:aws:iam::396287094661:role/githubdeploy-shoc-frontend-new-staging",
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-staging"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|