adam/seahaven-slack-bot
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(slack-bot): codify kms:Decrypt grants for CMK'd DynamoDB readers (INFRA-95) #51

Merged
amoussa1229 merged 2 commits from infra-95-slackbot-cmk-grants into main 2026-06-09 16:33:07 +00:00
Conversation 0 Commits 2 Files changed 3 +44

2 commits

Author SHA1 Message Date
Adam Moussa
9f8c6442fb
Merge branch 'main' into infra-95-slackbot-cmk-grants 2026-06-09 12:21:52 -04:00
Adam Moussa
58d688d5d5 feat(slack-bot): codify kms:Decrypt grants for CMK'd DynamoDB readers (INFRA-95 / M-3) 
wo-po-lookup, po-sync, and workorder-sync read WorkOrders,
WorkOrderComments, purchase-orders and PaymentsDashboard, which are now
SSE-encrypted with alias/seahaven-dynamodb. Tables are imported by name
so grantReadData adds no KMS perms; grant kms:Decrypt explicitly via the
CMK imported from SSM /seahaven/dynamodb/cmk-arn. Replaces the interim
CLI inline policy (Sid Infra95DynamoDbCmkDecrypt) with IaC.

INFRA-95
 2026-06-09 12:18:02 -04:00