adam/shoc-backend
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/shoc-backend.git synced 2026-10-07 16:19:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(cdk): scope EB platform ACL read

Browse source
This commit is contained in:
Alexandre Brandizzi 2026-07-28 14:30:48 -03:00
parent fa99240af5
commit 400ba09770
2 changed files with 17 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
infra/cdk/README.md
View file

@ -117,14 +117,17 @@ The role grants only:
Elastic Beanstalk emitted this read during the same attempt while validating
the uploaded application bundle. It grants no bucket-wide or cross-prefix
object access.
- `s3:GetObjectAcl` on only
`resources/environments/e-hehnrqjjrt/_runtime/*` in the same bucket. A
successful break-glass deployment showed that EB copies each immutable
application version, its embedded extensions, and its manifest under that
exact environment runtime prefix. The failed OIDC path already allowed the
source object, so the remaining ACL validation is limited to that proven
runtime boundary. This grant exposes ACL metadata only; it does not grant
runtime content reads or writes.
- `s3:GetObjectAcl` on only the active Elastic Beanstalk platform version
prefix
`elasticbeanstalk-platform-assets-us-east-1/stalks/eb_dotnet8_amazon_linux_2023_1.0.2939.0_20260625064821/*`.
The live environment stack references its platform configuration, hooks,
user-data script, and sample bundle under that exact AWS-owned prefix. An
audited account-bucket data-event trail captured source-bundle ACL reads but
did not capture the remaining denied ACL read, which rules out the previous
account-owned runtime-prefix inference. The grant therefore covers only ACL
metadata for the environment's currently deployed platform version; it
grants no platform object content read or write, no adjacent platform
version, and no account-owned runtime object access.
It grants **no** IAM mutation or `PassRole`, **no** RDS / Secrets Manager
access, no EC2 mutation, and **no** administrator policy. The only non-EB/S3

7
infra/cdk/deploy-dev-stack.ts
View file

@ -10,6 +10,9 @@ const ENVIRONMENT_ID = 'e-hehnrqjjrt';
const ENVIRONMENT_STACK_NAME = `awseb-${ENVIRONMENT_ID}-stack`;
const REPO = 'Sea-Haven-Industries/shoc-backend';
const BUCKET_NAME = `elasticbeanstalk-${REGION}-${ACCOUNT_ID}`;
const PLATFORM_ASSET_BUCKET_NAME = `elasticbeanstalk-platform-assets-${REGION}`;
const PLATFORM_ASSET_PREFIX =
'stalks/eb_dotnet8_amazon_linux_2023_1.0.2939.0_20260625064821';
export class DeployDevStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: cdk.StackProps = {}) {
@ -151,7 +154,9 @@ export class DeployDevStack extends cdk.Stack {
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['s3:GetObjectAcl'],
resources: [`${bucketArn}/resources/environments/${ENVIRONMENT_ID}/_runtime/*`],
resources: [
`arn:aws:s3:::${PLATFORM_ASSET_BUCKET_NAME}/${PLATFORM_ASSET_PREFIX}/*`,
],
}),
);