amadan
docs: inventory dev-agent-james — James's own AWS admin key, sealed in the vault (#837)
Also records infra/prod's provider lock additions from a darwin tofu init.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
3 files changed,
+45
−2
docs/secrets.md+6 −0infra/README.md+3 −2infra/prod/.terraform.lock.hcl+36 −0
diff --git a/docs/secrets.md b/docs/secrets.md| index 16288fd..028cb20 100644 |
| --- a/docs/secrets.md |
| +++ b/docs/secrets.md |
| @@ -147,6 +147,12 @@ private — is `docs/secrets-vault.md`. |
| - **`dev-agent` access key** — AdministratorAccess on the dev account, for |
| IaC; in 1Password. *Rotate*: IAM two-key rotation. To be replaced by scoped |
| roles once the OpenTofu skeleton defines them. |
| +- **`dev-agent-james` access key** — James's own AdministratorAccess user on |
| + the same account, same purpose (IaC/tofu runs), so each operator has a |
| + revocable identity and CloudTrail attribution. Sealed in the secrets vault |
| + (`aws-dev-agent-james.env`, bundled with the DNSimple token so one file |
| + covers an `infra/` run). *Rotate*: IAM two-key rotation + re-seal. |
| + *Revoke*: delete the IAM user — independent of `dev-agent`. |
| - **`litestream-fleet` access key** — object-rw on the fleet-backup bucket |
| only, lives in the router box's env file. *Blast radius*: read/delete |
| backup ciphertext — versioning (which this user cannot touch) keeps 14 days |
diff --git a/infra/README.md b/infra/README.md| index e4336f7..d07763b 100644 |
| --- a/infra/README.md |
| +++ b/infra/README.md |
| @@ -37,5 +37,6 @@ declared here. |
| - `eleven-dev-home-…` — the home vault bucket for the `s3Store` backend work |
| (#550 Part 1): same posture. |
| - A scoped `litestream-canary` IAM user/policy confined to the canary's prefix |
| - — the shape per-instance credentials will take; the admin `dev-agent` user |
| - is console-made and not managed here. |
| + — the shape per-instance credentials will take; the admin `dev-agent` and |
| + `dev-agent-james` users (one per operator; James's key is sealed in the |
| + secrets vault) are console-made and not managed here. |
diff --git a/infra/prod/.terraform.lock.hcl b/infra/prod/.terraform.lock.hcl| index 9d87350..929f947 100644 |
| --- a/infra/prod/.terraform.lock.hcl |
| +++ b/infra/prod/.terraform.lock.hcl |
| @@ -1,6 +1,42 @@ |
| # This file is maintained automatically by "tofu init". |
| # Manual edits may be lost in future updates. |
| +provider "registry.opentofu.org/dnsimple/dnsimple" { |
| + version = "1.10.0" |
| + constraints = "~> 1.0" |
| + hashes = [ |
| + "h1:EVDDjVKBij3ivkK6+tyS9jWxSExxVvOoGtMS8/M43f8=", |
| + "h1:HK5nqc5bZFdth/BcNc9GqUfXAYsDn8Ev/tgfmB0jMYI=", |
| + "h1:Hhbv3mnLhgY9NuvjzUqDo0PQKNTfStULx+m+S3wHKQg=", |
| + "h1:IHnPrj3/ayQ7PmKNkaq2nzoT87F+hnoSp5c/xdsPjnY=", |
| + "h1:O13KzReeaEXMiUe6qx2HDgHVVhBan2FnSiq41BMtSgo=", |
| + "h1:RN2gojQH/bA1zTRUOGdGH8w03uIa2agezDZyMY1VhV8=", |
| + "h1:UOCA/dFp2ORSVi/WlCCZrjjfXPUy9vpgk4PEBv6h4w0=", |
| + "h1:YyaCa5mDiLhM8lddBZyjKo5iM9lfunk0uA1X0uOSvoo=", |
| + "h1:ZNsEnMVMw39wrFufI7N5ypjnl92awiUlZ97z92MUPrs=", |
| + "h1:cQvKfEDJeGr3a0wWbGLoS+x0Orx8+9mWwSNAYfnqljM=", |
| + "h1:oV3AqgcHjXhMmoYmdHAerNEDRCkVq9QKvMnsyodsnSc=", |
| + "h1:r9RpaCOvjJjEZ6S3v3KPB6eNqf/STR9dYc94ippxhGk=", |
| + "h1:rIdsl1pgd2fqiSyB7lyn6gRh8RPq3MfCA5bt7q4NTWc=", |
| + "h1:zROoguvUNCxV46qrJGwbH7vEoUwxQJIfZrxb20teJa0=", |
| + "zh:025dbad287c9a9ca61b84fc4a14d3f595dbbc1139d5cf034597922264b756f6f", |
| + "zh:0c2fa8513004732f3aae6a408eb68ff9c2ad119f8bcefe491f0420ad0f4fe7d5", |
| + "zh:1ebb4cebfc29dfd8dd7f4a03f57aebe118a9dda15caf17eace06a16b40507317", |
| + "zh:5585c10af512519f006491bec5e63504e3682f61af4ab4c4807721de7764bf0f", |
| + "zh:571ead8072d43334d8ac169c86da21c9b325439508344898988f925f89ea7593", |
| + "zh:5bdd4d83e0831f0094f06c9d56aed7e1388967e9f4f4144d69c5c37d3d170e45", |
| + "zh:67982e17e937d71c1b2c83d740cd37a28c9c6ad16d325dddb91327303d6e96ff", |
| + "zh:7de0afaaed2668c27c7189180ceda3bc73e17b21a150ecec8eb3979e95875323", |
| + "zh:88911647fc4f8eaac3699b72ca7a0bee8f33521725b839b20235138f5072bfb7", |
| + "zh:8ad2a7f599864602e3126a9c31ec28b8c277090e98f80cd0d5e29eddb1bebae1", |
| + "zh:ac47ee0fd0837b57945fe961656f1f8e3c20e31178c49aafa7836b93aa5966a6", |
| + "zh:acdc1a9a5553d8d0e7aa887acfa0cf440f9c428dabc0c46b61d1b3eae6443e09", |
| + "zh:b3e3d236b72b5d975098f29e42a8eff071064de99cd81b27e264e5641aed7365", |
| + "zh:d21daf975282bdddc7c66580d0fde5395a0ed67fdfe3c3c87aec952a6604ba24", |
| + "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32", |
| + ] |
| +} |
| + |
| provider "registry.opentofu.org/hashicorp/aws" { |
| version = "6.54.0" |
| constraints = "~> 6.0" |