amadan
infra: box role lists, reads and deletes its own data bucket's object versions (claim Plan 2 Task 6)
Co-Authored-By: Codex <noreply@openai.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 files changed,
+28
−0
infra/modules/region-host/main.tf+14 −0infra/modules/region-remote-host/main.tf+14 −0
CI cancelled — superseded by a newer push — run details
diff --git a/infra/modules/region-host/main.tf b/infra/modules/region-host/main.tf| index 14b7724a6..97a13e100 100644 |
| --- a/infra/modules/region-host/main.tf |
| +++ b/infra/modules/region-host/main.tf |
| @@ -174,6 +174,20 @@ resource "aws_iam_role_policy" "host_buckets" { |
| Action = ["s3:ListBucket", "s3:GetBucketLocation"] |
| Resource = [var.deployment_bucket_arn, var.data_bucket_arn] |
| }, |
| + # Host lifecycle claim, Plan 2 (spec C3, §6.2, §6.5): exact-version |
| + # list, read and delete on this box's OWN data bucket. Sibling-region |
| + # moves/* grants are unchanged: the destination region retires its |
| + # own staging (spec N13). |
| + { |
| + Effect = "Allow" |
| + Action = ["s3:GetObjectVersion", "s3:DeleteObjectVersion"] |
| + Resource = ["${var.data_bucket_arn}/*"] |
| + }, |
| + { |
| + Effect = "Allow" |
| + Action = ["s3:ListBucketVersions"] |
| + Resource = [var.data_bucket_arn] |
| + }, |
| { |
| Effect = "Allow" |
| Action = ["ssm:GetParameter"] |
diff --git a/infra/modules/region-remote-host/main.tf b/infra/modules/region-remote-host/main.tf| index d18648e76..d86783977 100644 |
| --- a/infra/modules/region-remote-host/main.tf |
| +++ b/infra/modules/region-remote-host/main.tf |
| @@ -91,6 +91,20 @@ resource "aws_iam_user_policy" "host" { |
| Action = ["s3:ListBucket", "s3:GetBucketLocation"] |
| Resource = [aws_s3_bucket.data.arn] |
| }, |
| + # Host lifecycle claim, Plan 2 (spec C3, §6.2, §6.5): exact-version |
| + # list, read and delete on this box's OWN data bucket. Sibling-region |
| + # moves/* grants are unchanged: the destination region retires its |
| + # own staging (spec N13). |
| + { |
| + Effect = "Allow" |
| + Action = ["s3:GetObjectVersion", "s3:DeleteObjectVersion"] |
| + Resource = ["${aws_s3_bucket.data.arn}/*"] |
| + }, |
| + { |
| + Effect = "Allow" |
| + Action = ["s3:ListBucketVersions"] |
| + Resource = [aws_s3_bucket.data.arn] |
| + }, |
| ], |
| [for arn in var.sibling_staging_arns : { |
| Effect = "Allow" |