mirror of
https://github.com/Sea-Haven-Industries/security-review.git
synced 2026-09-30 08:03:17 +00:00
Adam Moussa
4c88c01f7b
Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced.
27 lines
746 B
JSON
27 lines
746 B
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "RolesAnywhereAssumeFromStepCaLeaf",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Service": "rolesanywhere.amazonaws.com"
|
|
},
|
|
"Action": [
|
|
"sts:AssumeRole",
|
|
"sts:TagSession",
|
|
"sts:SetSourceIdentity"
|
|
],
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"aws:PrincipalTag/x509Subject/CN": "r720-aws-posture",
|
|
"aws:PrincipalTag/x509Issuer/CN": "Sea Haven Internal CA - R720 Roles Anywhere",
|
|
"aws:SourceAccount": "328440206208"
|
|
},
|
|
"ArnEquals": {
|
|
"aws:SourceArn": "arn:aws:rolesanywhere:us-east-1:328440206208:trust-anchor/REPLACE_WITH_TRUST_ANCHOR_ID"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|