amadan

carlos / platform Public

infra: name the pull door's exact-version read grants (claim Plan 7 Task 4)

Co-Authored-By: Codex <noreply@openai.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
codex pushed by claude 87c8ef92615bd9c5e440b618c27d589e1097bede parent 9393b99
2 files changed, +16 −2
  • infra/modules/region-host/main.tf +8 −1
  • infra/modules/region-remote-host/main.tf +8 −1

CI passed — run details

diff --git a/infra/modules/region-host/main.tf b/infra/modules/region-host/main.tf
index 97a13e100..2e6880c18 100644
--- a/infra/modules/region-host/main.tf
+++ b/infra/modules/region-host/main.tf
@@ -179,11 +179,18 @@ resource "aws_iam_role_policy" "host_buckets" {
# moves/* grants are unchanged: the destination region retires its
# own staging (spec N13).
{
+ Sid = "PullDoorObjectVersions"
Effect = "Allow"
- Action = ["s3:GetObjectVersion", "s3:DeleteObjectVersion"]
+ Action = ["s3:GetObjectVersion"]
Resource = ["${var.data_bucket_arn}/*"]
},
{
+ Effect = "Allow"
+ Action = ["s3:DeleteObjectVersion"]
+ Resource = ["${var.data_bucket_arn}/*"]
+ },
+ {
+ Sid = "PullDoorVersionList"
Effect = "Allow"
Action = ["s3:ListBucketVersions"]
Resource = [var.data_bucket_arn]
diff --git a/infra/modules/region-remote-host/main.tf b/infra/modules/region-remote-host/main.tf
index d86783977..a5e4a203d 100644
--- a/infra/modules/region-remote-host/main.tf
+++ b/infra/modules/region-remote-host/main.tf
@@ -96,11 +96,18 @@ resource "aws_iam_user_policy" "host" {
# moves/* grants are unchanged: the destination region retires its
# own staging (spec N13).
{
+ Sid = "PullDoorObjectVersions"
Effect = "Allow"
- Action = ["s3:GetObjectVersion", "s3:DeleteObjectVersion"]
+ Action = ["s3:GetObjectVersion"]
Resource = ["${aws_s3_bucket.data.arn}/*"]
},
{
+ Effect = "Allow"
+ Action = ["s3:DeleteObjectVersion"]
+ Resource = ["${aws_s3_bucket.data.arn}/*"]
+ },
+ {
+ Sid = "PullDoorVersionList"
Effect = "Allow"
Action = ["s3:ListBucketVersions"]
Resource = [aws_s3_bucket.data.arn]