Refuse the org root in IAM; tidy dependabot, lock file, config - #22
Merged
Merged
Conversation
…ock, optional github_repo orgseed-ci's AttachPolicy/DetachPolicy resources no longer include the organization root unless AllowAttachToRoot=true (default false), so the 'never the root' guard is enforced by IAM and not only by Terraform code. prove.yml gains two real-call probes for it. SECURITY.md records that tag-scoping SCP actions is not possible in AWS and what compensates. Also: Dependabot watches modules/* and stacks/*; the root stack's provider lock file is committed; github_repo is no longer required; the unused modules/ci-role scaffold is removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
1. IAM refuses the organization root by default.
orgseed-cicould attach or detach an SCP at the org root - a guardrail there hits every member account at once and only the management account can undo it. The baseline stack already refused a root target, but that was Terraform code. The root ARN is now in the role'sAttachPolicy/DetachPolicyresources only when the new bootstrap parameterAllowAttachToRootistrue(defaultfalse).prove.ymlprobes ask, asorgseed-ci, to attach and detach an SCP at a root-shaped target. The policy ID is nonexistent but matches the allowed policy pattern, so the root is the only possible cause of a denial, and a wrongly-allowed call fails harmlessly withPolicyNotFound. The safety test now allowsattach_policy/detach_policyonly against a nonexistent policy.SECURITY.mdrecords a limit I could not remove: AWS does not support tag conditions onUpdatePolicy/DeletePolicy/AttachPolicy/DetachPolicy(checked in the Service Authorization Reference), soorgseed-cican still edit any customer-managed SCP. Compensating controls are listed.2. Tidy
modules/*andstacks/*(it pointed at/modules, which holds no.tffiles, so it never ran for Terraform). A test keeps it that way.stacks/baseline/.terraform.lock.hclis committed (linux/windows/mac) so plan and apply use the same provider build. A test requires it.github_repois optional; nothing read it.modules/ci-rolescaffold and its README mentions.Verification
ruff/banditoncli/, cfn-lint, Checkov (35/0) clean;terraform test13/13 and 4/4.Not verified yet
The change only takes effect once the
seedworkflow updates theorgseed-roles-sandboxstack, and the two new probes have never run against real AWS. After merging: runseed(approve), thenprove(approve) - it should show 19 verdicts, with the root probes denied. If a probe reads as authorized or errors, that is a real finding.