diff --git a/infra/cdk/README.md b/infra/cdk/README.md index 7555c73..b3953b7 100644 --- a/infra/cdk/README.md +++ b/infra/cdk/README.md @@ -40,15 +40,18 @@ The role grants only: describe actions are not reliably constrained by resource ARN. - `elasticbeanstalk:CreateApplicationVersion` on application `shoc-backend`. - `elasticbeanstalk:UpdateEnvironment` on environment `shoc-backend-dev` only. -- `s3:ListBucket` on `elasticbeanstalk-us-east-1-396287094661` (the official - action's ownership-safe `HeadBucket` check), plus `s3:CreateBucket` on the - same bucket-level ARN. Under the `shoc-backend/` object prefix only: - `s3:PutObject` plus `s3:GetObject` and `s3:GetObjectVersion`, which the - pinned official deployment action requires to validate the - `CreateApplicationVersion` source bundle after upload. +- `s3:ListBucket` and `s3:GetBucketLocation` on + `elasticbeanstalk-us-east-1-396287094661` (the official action's + ownership-safe bucket checks), plus `s3:CreateBucket` and + `s3:PutBucketOwnershipControls` on the same bucket-level ARN. Under the + `shoc-backend/` object prefix only: + `s3:PutObject`, `s3:GetObject`, `s3:GetObjectAcl`, and + `s3:GetObjectVersion`, which the pinned official deployment action and + Elastic Beanstalk require to validate the `CreateApplicationVersion` source + bundle after upload. `s3:CreateBucket` is part of the pinned - `aws-actions/aws-elasticbeanstalk-deploy@cfad3e5e...` (v1.0.6) IAM + `aws-actions/aws-elastic-beanstalk-deploy@cfad3e5e...` (v1.0.6) IAM contract even though the workflow sets `create-s3-bucket-if-not-exists: "false"`. That input prevents the action's explicit bucket-creation helper; it does not remove the permission @@ -59,9 +62,53 @@ The role grants only: exact bucket-level ARN only (no object prefix, no wildcard resource), so it cannot create any other bucket. -It grants **no** IAM mutation or `PassRole`, **no** RDS / EC2 / Secrets Manager -access, and **no** administrator policy. There are no wildcard mutation -surfaces. + `s3:PutBucketOwnershipControls` was added after a second live deployment + (run 30375409934) failed at `UpdateEnvironment` with `AccessDenied` for + `s3:PutBucketOwnershipControls` on the same service bucket. That call is + emitted by Elastic Beanstalk's `UpdateEnvironment` path after the source + bundle upload succeeds; AWS classifies it as a bucket-level permission, so + it is scoped to the same exact bucket-level ARN (no object prefix, no + wildcard resource). It does not widen object-prefix permissions, does not + grant `PutBucketPolicy`, `PutBucketPublicAccessBlock`, or any object-level write, + and does not change `create-s3-bucket-if-not-exists: "false"`. + + `s3:GetBucketLocation` was added after CloudTrail showed that run + `30375409934` attempt 4 invoked it as + `githubdeploy-shoc-backend-dev/GitHubActions` and was denied. It is scoped to + the exact bucket-level ARN and grants no object access. + +- `cloudformation:GetTemplate`, `cloudformation:DescribeStackResources`, and + `cloudformation:ListStackResources` on the Elastic Beanstalk-managed + CloudFormation stack `awseb-e-hehnrqjjrt-stack`, scoped to + `arn:aws:cloudformation:us-east-1:396287094661:stack/awseb-e-hehnrqjjrt-stack/*`. + These read-only calls are emitted by Elastic Beanstalk's + `UpdateEnvironment` path under the GitHub deploy role. `GetTemplate` was + added after run `30375409934` attempt 2 advanced past the S3 + ownership-controls step and was denied on the EB-managed stack instance + `awseb-e-hehnrqjjrt-stack/112f77c0-7718-11f1-a1a9-0e48750aef13`. + CloudTrail then showed attempt 4 denied `DescribeStackResources` and + `ListStackResources` on that same stack instance. + CloudFormation stack ARNs carry a random GUID instance suffix, so the + permission is scoped to that one stack-name prefix (`/*`) rather than a + single instance ARN. The statement grants no CloudFormation mutation, no + `Resource: "*"`, and no access to any other stack. CDK does not own or + mutate that stack; it is owned by Elastic Beanstalk and referenced by + identifier only. + +- `ec2:DescribeSubnets` as a read-only account-level query. Elastic Beanstalk + emitted this call during run 30375409934 attempt 3 after the environment + update started. EC2 does not support resource-level constraints for this + Describe action, so IAM requires `Resource: "*"`. No EC2 mutation action is + granted. +- `s3:GetObjectAcl` under the existing + `elasticbeanstalk-us-east-1-396287094661/shoc-backend/*` object prefix. + Elastic Beanstalk emitted this read during the same attempt while validating + the uploaded application bundle. It grants no bucket-wide or cross-prefix + object access. + +It grants **no** IAM mutation or `PassRole`, **no** RDS / Secrets Manager +access, no EC2 mutation, and **no** administrator policy. There are no wildcard +mutation surfaces. ## Prerequisites @@ -92,7 +139,10 @@ All commands run from `infra/cdk/`. - Trust policy `StringEquals` matches the exact audience and subject above. - The inline policy contains no `Resource: "*"` mutation action and no service - outside `elasticbeanstalk` / `s3`. + outside `elasticbeanstalk` / `s3` / `cloudformation` / `ec2`. The + `cloudformation` grants are the three observed read-only actions on the + single EB-managed stack prefix; the only EC2 grant is the read-only + `DescribeSubnets` action whose IAM resource model requires `Resource: "*"`. The workflow's `AWS_DEPLOY_ROLE_ARN` repository secret (environment `dev`) must hold the ARN output by this stack (`GithubDeployRoleArn`). diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts index b1e188c..9302a9f 100644 --- a/infra/cdk/deploy-dev-stack.ts +++ b/infra/cdk/deploy-dev-stack.ts @@ -73,7 +73,34 @@ export class DeployDevStack extends cdk.Stack { deployRole.addToPolicy( new iam.PolicyStatement({ effect: iam.Effect.ALLOW, - actions: ['s3:ListBucket', 's3:CreateBucket'], + actions: [ + 'cloudformation:GetTemplate', + 'cloudformation:DescribeStackResources', + 'cloudformation:ListStackResources', + ], + resources: [ + `arn:aws:cloudformation:${REGION}:${ACCOUNT_ID}:stack/awseb-e-hehnrqjjrt-stack/*`, + ], + }), + ); + + deployRole.addToPolicy( + new iam.PolicyStatement({ + effect: iam.Effect.ALLOW, + actions: ['ec2:DescribeSubnets'], + resources: ['*'], + }), + ); + + deployRole.addToPolicy( + new iam.PolicyStatement({ + effect: iam.Effect.ALLOW, + actions: [ + 's3:ListBucket', + 's3:CreateBucket', + 's3:PutBucketOwnershipControls', + 's3:GetBucketLocation', + ], resources: [bucketArn], }), ); @@ -81,7 +108,7 @@ export class DeployDevStack extends cdk.Stack { deployRole.addToPolicy( new iam.PolicyStatement({ effect: iam.Effect.ALLOW, - actions: ['s3:GetObject', 's3:GetObjectVersion', 's3:PutObject'], + actions: ['s3:GetObject', 's3:GetObjectAcl', 's3:GetObjectVersion', 's3:PutObject'], resources: [`${bucketArn}/${APPLICATION_NAME}/*`], }), );