sh-openswe-traces

adam/sh-openswe-traces

Fork 0

mirror of https://github.com/Sea-Haven-Industries/sh-openswe-traces.git synced 2026-10-03 02:13:31 +00:00

Commit graph

Author	SHA1	Message	Date
Adam Moussa	5f430d9dfd	feat(infra): convert sh-openswe-traces to HCP Terraform (#8 ) Freeze SAM CD and add terraform/ for seahaven-prod with account-suffixed buckets so HCP owns deploy before mgmt cutover. Suppress CKV_AWS_40 for the LangSmith export IAM user with documented mitigations.	2026-08-05 18:33:03 -04:00
Adam Moussa	dbd41bb52c	chore(security): add repo-local suppressions for adjudicated IAM FPs (#3 ) Some checks failed Deploy / deploy (push) Has been cancelled Details Moves proof-or-kill-verified checkov false positives on bootstrap.yaml ExecRole (CFN-only role, ARN-scoped IAM-user actions gated by an explicit anti-escalation Deny; KMS CreateKey Resource:* inherent to key creation) from machine-level to a tracked repo-local .security-review/suppressions.json so the Open SWE daily-report automation resolves them. Machine-level copy retained until merge.	2026-07-13 14:30:58 -04:00

Author

SHA1

Message

Date

Adam Moussa

5f430d9dfd

feat(infra): convert sh-openswe-traces to HCP Terraform (#8 )

Freeze SAM CD and add terraform/ for seahaven-prod with account-suffixed
buckets so HCP owns deploy before mgmt cutover. Suppress CKV_AWS_40 for
the LangSmith export IAM user with documented mitigations.

2026-08-05 18:33:03 -04:00

Adam Moussa

dbd41bb52c

chore(security): add repo-local suppressions for adjudicated IAM FPs (#3 )

Deploy / deploy (push) Has been cancelled

Details

Moves proof-or-kill-verified checkov false positives on bootstrap.yaml ExecRole
(CFN-only role, ARN-scoped IAM-user actions gated by an explicit anti-escalation
Deny; KMS CreateKey Resource:* inherent to key creation) from machine-level to a
tracked repo-local .security-review/suppressions.json so the Open SWE
daily-report automation resolves them. Machine-level copy retained until merge.

2026-07-13 14:30:58 -04:00

2 commits