infra/cdk/README.md

@@ -42,8 +42,7 @@ The role grants only:
 - `elasticbeanstalk:UpdateEnvironment` on environment `shoc-backend-dev` only.
 - `s3:ListBucket` and `s3:GetBucketLocation` on
   `elasticbeanstalk-us-east-1-396287094661` (the official action's
-  ownership-safe bucket checks), `s3:GetBucketPolicy` for the policy inspection
-  observed in attempt 11 of run `30448885838`, plus `s3:CreateBucket` and
+  ownership-safe bucket checks), plus `s3:CreateBucket` and
   `s3:PutBucketOwnershipControls` on the same bucket-level ARN. Under the
   `shoc-backend/` object prefix only:
   `s3:PutObject`, `s3:GetObject`, and `s3:GetObjectVersion`, which the pinned
@@ -78,12 +77,6 @@ The role grants only:
   above. Attempt 10 showed that Elastic Beanstalk verifies the materialized
   environment copy with `HeadObject`, which S3 authorizes through
   `s3:GetObject`. The shared embedded-extension prefix remains write-only.
-- `s3:GetObject` and `s3:PutObject` on only
-  `elasticbeanstalk-us-east-1-396287094661/resources/environments/e-hehnrqjjrt/_runtime/versions/*`.
-  Attempt 12 showed Elastic Beanstalk reading the previous environment version
-  manifest and writing its replacement under this exact dev-environment
-  runtime prefix. The grant excludes deletes, ACL mutation, other environments,
-  and application bundle content.
 - `s3:GetObjectAcl` on objects under the service-wide
   `arn:aws:s3:::elasticbeanstalk-*/*` namespace. AWS Support case
   `178526484500047` confirmed that `UpdateEnvironment` uses the initiating

infra/cdk/deploy-dev-stack.ts

@@ -27,9 +27,6 @@ export class DeployDevStack extends cdk.Stack {
     const environmentEmbeddedExtensionArn =
       `${bucketArn}/resources/environments/${ENVIRONMENT_ID}` +
       `/_runtime/_embedded_extensions/${APPLICATION_NAME}/*`;
-    const runtimeManifestArn =
-      `${bucketArn}/resources/environments/${ENVIRONMENT_ID}` +
-      '/_runtime/versions/*';
     const oidcProviderArn = `arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com`;
 
     const deployRole = new iam.Role(this, 'GithubDeployRole', {
@@ -146,7 +143,6 @@ export class DeployDevStack extends cdk.Stack {
           's3:CreateBucket',
           's3:PutBucketOwnershipControls',
           's3:GetBucketLocation',
-          's3:GetBucketPolicy',
         ],
         resources: [bucketArn],
       }),
@@ -196,16 +192,6 @@ export class DeployDevStack extends cdk.Stack {
       }),
     );
 
-    deployRole.addToPolicy(
-      new iam.PolicyStatement({
-        effect: iam.Effect.ALLOW,
-        actions: ['s3:GetObject', 's3:PutObject'],
-        // UpdateEnvironment reads the prior environment version manifest and
-        // writes its replacement under this environment-only runtime prefix.
-        resources: [runtimeManifestArn],
-      }),
-    );
-
     deployRole.addToPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,