From 7e0d7b031a0b8dca55e4276348fc964da5f6f962 Mon Sep 17 00:00:00 2001
From: Roy Osherove <575051+royosherove@users.noreply.github.com>
Date: Sun, 11 Oct 2026 12:27:48 +0000
Subject: [PATCH] fix(idle-shutdown): give DescribeInstanceStatus Resource * in
 the wake policy

EC2 Describe* actions do not support resource-level permissions. They
match only "Resource": "*". The wake Lambda policy gave
ec2:DescribeInstanceStatus only on the instance ARN, so the call in
wake-lambda/index.mjs got AccessDenied before StartInstances ran.

Move ec2:DescribeInstanceStatus to its own statement with Resource "*".
Keep ec2:StartInstances limited to the instance ARN. Add
tests/test-idle-wake-policy.sh, which reads the policy from
install-idle.sh and checks both statements.

Fixes #129

Crew: Drew (Kiro Crew Issue Radar)
---
 .../optional/idle-shutdown/install-idle.sh    |  3 +-
 tests/test-idle-wake-policy.sh                | 96 +++++++++++++++++++
 2 files changed, 98 insertions(+), 1 deletion(-)
 create mode 100755 tests/test-idle-wake-policy.sh

diff --git a/bootstraps/optional/idle-shutdown/install-idle.sh b/bootstraps/optional/idle-shutdown/install-idle.sh
index bd99f9b..8d87d2e 100755
--- a/bootstraps/optional/idle-shutdown/install-idle.sh
+++ b/bootstraps/optional/idle-shutdown/install-idle.sh
@@ -233,8 +233,9 @@ JSON
 
 WAKE_INLINE=$(cat <<JSON
 {"Version":"2012-10-17","Statement":[
-  {"Effect":"Allow","Action":["ec2:StartInstances","ec2:DescribeInstanceStatus"],
+  {"Effect":"Allow","Action":["ec2:StartInstances"],
    "Resource":"arn:aws:ec2:${REGION}:${ACCT_ID}:instance/${INSTANCE_ID}"},
+  {"Effect":"Allow","Action":["ec2:DescribeInstanceStatus"],"Resource":"*"},
   {"Effect":"Allow","Action":["ssm:GetParameter","ssm:PutParameter","ssm:DeleteParameter"],"Resource":[
     "arn:aws:ssm:${REGION}:${ACCT_ID}:parameter/openclaw/wake-token",
     "arn:aws:ssm:${REGION}:${ACCT_ID}:parameter/openclaw/wake-config/*"
diff --git a/tests/test-idle-wake-policy.sh b/tests/test-idle-wake-policy.sh
new file mode 100755
index 0000000..6d1a706
--- /dev/null
+++ b/tests/test-idle-wake-policy.sh
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# tests/test-idle-wake-policy.sh — Contract test for the wake Lambda IAM policy
+# in bootstraps/optional/idle-shutdown/install-idle.sh.
+#
+# EC2 Describe* actions do not support resource-level permissions. They match
+# only "Resource": "*". This test reads the WAKE_INLINE policy from the script
+# and makes sure that:
+#   - the policy is valid JSON after variable substitution
+#   - each statement with an ec2:Describe* action has "Resource": "*"
+#   - ec2:StartInstances stays limited to the one instance ARN
+#
+# No AWS required. Run standalone or via CI (discovered by pack-tests.yml).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+INSTALL="$REPO_ROOT/bootstraps/optional/idle-shutdown/install-idle.sh"
+
+if [[ ! -f "$INSTALL" ]]; then
+  echo "FAIL: install-idle.sh not found at $INSTALL" >&2
+  exit 1
+fi
+
+RED='\033[0;31m'; GREEN='\033[0;32m'; BOLD='\033[1m'; NC='\033[0m'
+PASS=0; FAIL=0
+
+pass() { printf "${GREEN}  \xE2\x9C\x93${NC} %s\n" "$1"; PASS=$((PASS + 1)); }
+fail() { printf "${RED}  \xE2\x9C\x97${NC} %s\n" "$1"; FAIL=$((FAIL + 1)); }
+
+printf "${BOLD}idle-shutdown wake Lambda IAM policy${NC}\n"
+
+# Get the heredoc body between 'WAKE_INLINE=$(cat <<JSON' and the closing 'JSON'.
+POLICY="$(awk '/^WAKE_INLINE=\$\(cat <<JSON$/{f=1; next} f && /^JSON$/{exit} f' "$INSTALL")"
+
+if [[ -z "$POLICY" ]]; then
+  fail "WAKE_INLINE heredoc found in install-idle.sh"
+  printf "\n%d passed, %d failed\n" "$PASS" "$FAIL"
+  exit 1
+fi
+pass "WAKE_INLINE heredoc found in install-idle.sh"
+
+# Check the policy with Python. Each output line is "PASS <msg>" or "FAIL <msg>".
+RESULTS="$(POLICY="$POLICY" python3 - <<'PY'
+import json, os
+
+region, acct, inst = "us-east-1", "123456789012", "i-0123456789abcdef0"
+text = (os.environ["POLICY"]
+        .replace("${REGION}", region)
+        .replace("${ACCT_ID}", acct)
+        .replace("${INSTANCE_ID}", inst))
+instance_arn = f"arn:aws:ec2:{region}:{acct}:instance/{inst}"
+
+def out(ok, msg):
+    print(("PASS " if ok else "FAIL ") + msg)
+
+try:
+    doc = json.loads(text)
+except ValueError as e:
+    out(False, f"policy is valid JSON ({e})")
+    raise SystemExit(0)
+out(True, "policy is valid JSON")
+
+def as_list(v):
+    return v if isinstance(v, list) else [v]
+
+stmts = as_list(doc.get("Statement", []))
+describe_seen = False
+start_seen = False
+for s in stmts:
+    actions = as_list(s.get("Action", []))
+    resources = as_list(s.get("Resource", []))
+    describes = [a for a in actions if a.startswith("ec2:Describe")]
+    if describes:
+        describe_seen = True
+        out(resources == ["*"],
+            f"{', '.join(describes)} uses Resource \"*\" (got {resources})")
+    if "ec2:StartInstances" in actions:
+        start_seen = True
+        out(resources == [instance_arn],
+            f"ec2:StartInstances is limited to the instance ARN (got {resources})")
+
+out(describe_seen, "policy allows ec2:DescribeInstanceStatus")
+out(start_seen, "policy allows ec2:StartInstances")
+PY
+)"
+
+while IFS= read -r line; do
+  [[ -z "$line" ]] && continue
+  case "$line" in
+    PASS\ *) pass "${line#PASS }" ;;
+    *)       fail "${line#FAIL }" ;;
+  esac
+done <<< "$RESULTS"
+
+printf "\n%d passed, %d failed\n" "$PASS" "$FAIL"
+[[ "$FAIL" -eq 0 ]]