Skip to content

fix(aws): grant scoped D7 provider refresh reads - #7

Closed
harrisonoconnorhover wants to merge 432 commits into
WagnerJ-Dev:mainfrom
harrisonoconnorhover:codex/aws-d7-provider-read-policy
Closed

harrisonoconnorhover wants to merge 432 commits into
WagnerJ-Dev:mainfrom
harrisonoconnorhover:codex/aws-d7-provider-read-policy

Conversation

@harrisonoconnorhover

Copy link
Copy Markdown
Contributor

What changed

  • grant only the AWS provider reads needed to resolve the selected VPC and CloudFront prefix list
  • add the deterministic listener, disposable D7 bucket, and D7 log-group refresh reads
  • keep bucket and log-tag access resource-scoped and reject wildcard service reads in the focused test

Why

The first temporary-credential foundation plan stopped before saving a plan or creating resources because two provider discovery reads were absent. Review of the locked provider paths identified the related reads that would otherwise fail during post-create refresh.

Impact

This changes only the retained deployment-role policy. It does not modify the AWS application root, create provider resources, or broaden D7 support status.

Checks

  • 15 focused AWS bootstrap tests
  • Ruff lint and format
  • Terraform fmt, init without backend, validate, and test
  • git diff check
  • independent adversarial completion review

harrisonoconnorhover and others added 30 commits August 10, 2026 06:38
…metry-v2

Add safe Redshift operation telemetry
…ct-transport-v2

Add bounded direct Redshift staging
…iter-modes

Add all PostgreSQL writer modes
…aph-runtime

Execute portable graphs on PostgreSQL
…bernetes-live-proof

Accept PostgreSQL on the Kubernetes lifecycle
…e-qualification

Qualify Snowflake warehouse runtime
…-qualification

Qualify experimental Redshift runtime
…p-reconciliation

Reconcile Phase 5 roadmap and evidence
Replace launcher primitives with a resolved template request
Add the shared four-warehouse correctness gate
Fix live warehouse correctness failure handling
harrisonoconnorhover and others added 27 commits August 14, 2026 13:36
…-qualification

docs: record D7 local live qualification
Prepare the corrected qualification candidate, preserve public RC20, and record RC22-specific cost authorization.
…-control-plane

Add Kubernetes hosted control plane
…-bootstrap-verifier-fix

fix(kubernetes): verify served bootstrap bytes
…-live-evidence

docs(kubernetes): accept D7 live qualification
…l-plane

Add GCP hosted control-plane profile
…e-verifier-shape

Fix GCP bucket verifier CLI shape
…erifier-provider-shapes

fix(gcp): align live verifier with Cloud Run
…it-service-scaling-defaults

fix(gcp): record Cloud Run scaling defaults
…l-plane-live-evidence

Record GCP D7 Control-plane live qualification
…ment-authority

Authorize scoped AWS D7 deployment resources
…l-plane

Add AWS D7 hosted control profile
…o-kms-backend-fix

Pin AWS state backend to stage-zero KMS key
@harrisonoconnorhover

Copy link
Copy Markdown
Contributor Author

Opened against the wrong repository by automation; no changes were merged.

@harrisonoconnorhover
harrisonoconnorhover deleted the codex/aws-d7-provider-read-policy branch August 15, 2026 03:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant