adam/security-review
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/security-review.git synced 2026-09-30 12:43:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
security-review/iam
History
Adam Moussa 4023928939
docs(iam): repoint cross-family review invocations to cross_review.py
2026-07-14 19:10:03 -04:00
..
aws-posture-readonly-policy.json chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo 2026-06-29 11:41:41 -04:00
aws-posture-readonly-policy.rationale.md chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo 2026-06-29 11:41:41 -04:00
aws-posture-trust-policy.json chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo 2026-06-29 11:41:41 -04:00
CROSS-REVIEW-PACKET.md docs(iam): repoint cross-family review invocations to cross_review.py 2026-07-14 19:10:03 -04:00
README.md docs(iam): repoint cross-family review invocations to cross_review.py 2026-07-14 19:10:03 -04:00
roles-anywhere-config.json chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo 2026-06-29 11:41:41 -04:00
step-ca-config-sketch.md chore: import security-review gate, sweep, and Plane-1 checkers into standalone repo 2026-06-29 11:41:41 -04:00

README.md

security-review/iam/ — Phase-3 IAM artifacts (authored for cross-review, NOT applied)

These are the IAM / Roles Anywhere / step-ca artifacts for the R720 agent-team aws-posture checker (design docs/r720-agent-team-design.md D5 / §4 / §6.3 / §7 Phase 3).

Nothing here is applied to AWS. They are FILES for the mandatory GPT-4.1 IAM cross-review.

Cross-review status (2026-06-18): APPROVE, no BLOCKs. FIXes applied — aws:SourceAccount added to the trust policy; ec2:DescribeImages removed from the permission policy (see CROSS-REVIEW-PACKET.md header + aws-posture-readonly-policy.rationale.md). The review passing unblocked building ../checkers/aws-posture.sh (built in this Phase-3 change set). That checker stays PROVISIONING-GATED: it makes NO AWS call until step-ca + the Roles Anywhere trust anchor + this role are stood up. Provisioning happens only after the review is recorded (design §7, B3) — and a VM snapshot is taken first per feedback_ec2_replacement_snapshot.

Decision (D5): the box stays read-only and authenticates to AWS via Roles Anywhere short-lived leaf certs issued by a new internal step-ca — no long-lived AWS key on the box.

File Purpose
CROSS-REVIEW-PACKET.md Start here. End-to-end trust model, least-privilege rationale, blast radius, exercised rollback, and the specific items for the reviewer.
aws-posture-readonly-policy.json Least-privilege read-only permission policy (valid, applyable IAM JSON).
aws-posture-readonly-policy.rationale.md Statement-by-statement rationale (IAM JSON can't carry comments).
aws-posture-trust-policy.json Role trust policy — pins Roles Anywhere + the leaf subject/issuer CN + trust-anchor ARN.
roles-anywhere-config.json Trust-anchor (pins step-ca root) + profile (1h session) config.
step-ca-config-sketch.md Internal CA config + systemd-timer auto-renewal of the short-lived leaf.

Per global instructions this IAM change also requires the GPT-4.1 cross-family review via python3 ~/Documents/repositories/seahaven/security-review/cross_review.py "<task>"; this directory is that review's input.