carlos / platform Public

What

The region-host module's store-user permissions boundary (infra/modules/region-host/main.tf, aws_iam_policy.store_user_boundary) allows s3:GetObject, s3:PutObject and s3:DeleteObject on ${store_bucket_prefix}*/*, but not s3:GetObjectTagging.

internal/objstore/aws.go storePolicyJSON grants every store user s3:GetObjectTagging (scan verdicts are object tags). A boundary is an intersection, so any store user created under the module's boundary cannot read tags, whatever its inline policy says. Its comment notes that adding GetObjectTagging rewrites every store's policy on the next grant re-walk, but the module's boundary was never widened to match.

Who it affects

Every deployment whose region-host sets store_bucket_prefix, which includes the flagship (carlos-flagship-host-store-boundary). Not verified live: I read the module and objstore on main (fe2088e3), and did not simulate a flagship store user.

Tito is not affected. Its boundary lives in its own tofu and was widened on 2026-10-07 under #201 (teamtito/carlos-infrastructure#18).

Fix

1. Add s3:GetObjectTagging to the boundary's object statement.
2. Add a test, or a check in the module, that the boundary is a superset of storePolicyJSON's Allow actions, so the two cannot drift again.
3. Apply the flagship root, which is pinned to release tags since 2026-10-01, so it needs a tag carrying the module change.

Until then, check whether any flagship app reads scan verdicts through its store credentials. A simulation on one flagship store user, s3:GetObjectTagging on its bucket, would confirm the gap is real.