From 98f462ac948f4d2170af85907fc17f5017a1e380 Mon Sep 17 00:00:00 2001 From: Alexander Amiri Date: Sun, 8 Mar 2026 22:43:00 +0100 Subject: [PATCH] =?UTF-8?q?Remove=20CloudTrail=20from=20monitoring=20modul?= =?UTF-8?q?e=20=E2=80=94=20managed=20in=20org/?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The trail and S3 bucket are in terraform/org/cloudtrail.tf (human-applied). CI role's permission boundary blocks cloudtrail:DeleteTrail, causing apply failures. --- CLAUDE.md | 23 ++-- docs/team-lifecycle.md | 30 +++++ scripts/post-review-comment.sh | 12 +- .../lambda-src/team_provisioner/handler.py | 9 +- terraform/platform/lambdas/main.tf | 4 +- terraform/platform/monitoring/main.tf | 103 ------------------ 6 files changed, 53 insertions(+), 128 deletions(-) create mode 100644 docs/team-lifecycle.md diff --git a/CLAUDE.md b/CLAUDE.md index 3634e5c..051913c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -122,10 +122,12 @@ terraform/platform/ ### Terraform — Org (human-applied, no CI) ``` terraform/org/ - main.tf AWS Organizations, SCPs - providers.tf Provider config - variables.tf Variables - backend.tf Separate state key + main.tf AWS Organizations, SCPs + identity-center.tf IAM Identity Center, permission sets, ABAC (team attribute from SAML) + cloudtrail.tf CloudTrail trail + S3 bucket + providers.tf Provider config + variables.tf Variables + backend.tf Separate state key ``` ### Terraform — State (bootstrapped) @@ -260,13 +262,13 @@ The SA JSON key is at `/javabin/platform/google-admin-sa`, the impersonation tar | 0a | AWS Discovery | **Done** | | 0b | Bootstrap State Backend | **Done** — S3 backend live | | 0c | Organizations + Permission Boundary | **Done** — org enabled, boundary deployed, SCP deferred | -| 1 | Identity (Google + Identity Center + Cognito) | **Partially done** — GCP SA with domain-wide delegation configured, GitHub App credentials in SSM. Cognito pool Terraform exists in `identity/` and is wired in `main.tf`, but not yet applied with Google IdP config. Identity Center lives in `terraform/org/`. | +| 1 | Identity (Google + Identity Center + Cognito) | **Deployed** — GCP SA with domain-wide delegation, Identity Center with ABAC + 3 permission sets in `terraform/org/`. Cognito pool TF exists but not yet applied (needs Google OAuth client). | | 2a | Networking | **Deployed** — VPC, subnets, NAT | | 2b | Ingress | **Deployed** — ALB + ACM cert | -| 2c | IAM / OIDC | **Deployed** — 4 CI roles + per-app roles | +| 2c | IAM / OIDC | **Deployed** — 5 CI roles (infra, per-app, deploy, override-approver, registry) | | 2d | Compute | **Deployed** — ECS cluster + ECR repos | | 2e | Monitoring | **Deployed** — GuardDuty, Security Hub, Config, SNS | -| 2f | Lambda Functions | **Deployed** — 5 working + team-provisioner (stub only) | +| 2f | Lambda Functions | **Deployed** — 6 working (Google/GitHub/Budget sync live, Cognito/IdC sync not yet implemented in Lambda) | | 2g | Platform CI | **Done** — plan → LLM review → apply pipeline working | | 3a | Reusable Terraform Modules | **Code done** — 12 modules in repo | | 3b | GitHub Actions Workflows | **Code done** — 14 reusable workflows | @@ -277,9 +279,10 @@ The SA JSON key is at `/javabin/platform/google-admin-sa`, the impersonation tar | 4 | App Onboarding | **Partially working** — platform-test-app full pipeline passes (plan → review → apply → docker-build), ECS deploy fails on service stabilization | ### Known Issues -- **ECS deploy stabilization**: platform-test-app task registers but service fails health check — likely networking or port config -- **Cognito pools not yet applied**: `identity/` has Terraform wired in `main.tf`, but requires `google_client_id`/`google_client_secret`/`certificate_arn` variables -- **`registered_app_repos` manually managed**: Per-repo IAM roles require entries in this variable. No automated mechanism yet — add repos manually to `registered-apps.auto.tfvars` +- **ECS deploy stabilization**: platform-test-app task registers but service fails health check +- **Cognito pools not yet applied**: TF exists but needs Google OAuth client credentials +- **Team provisioner Lambda**: Google/GitHub/Budget sync working. Cognito and Identity Center sync functions are stubs — need implementation to create groups and assign members +- **`registered_app_repos` manually managed**: Being replaced with team-scoped IAM roles (repo→team resolved via GitHub API at runtime) ## Agent Guidelines diff --git a/docs/team-lifecycle.md b/docs/team-lifecycle.md new file mode 100644 index 0000000..d305886 --- /dev/null +++ b/docs/team-lifecycle.md @@ -0,0 +1,30 @@ +# Team Lifecycle — Open Questions + +## What works today + +- **Member added**: Lambda adds to Google Group + GitHub team +- **Member removed**: Lambda removes from Google Group + GitHub team +- **Team created**: Lambda creates Google Group, GitHub team, AWS Budget +- **Description/budget changed**: Lambda updates in place + +## What doesn't work yet + +### Team deletion + +Deleting a team YAML from the registry does nothing. The Lambda only processes files that exist — a deleted file can't be read. Orphaned resources remain: + +- Google Group (`team-{name}@java.no`) +- GitHub team +- AWS Budget +- IAM role (once team-scoped roles are implemented) + +### Repos after team deletion + +Repos that were in the deleted GitHub team lose their team association. CI stops working because there's no IAM role to assume. The repos themselves are untouched. + +## Decisions needed + +1. **Should team deletion be destructive?** Auto-delete Google Group, GitHub team, budget, IAM role? Or archive/disable? +2. **Should deletion be blocked if the team still has repos?** Force teams to remove repos before deleting. +3. **How to detect deletions in CI?** The registry workflow could compare deleted files in the git diff and send a separate "delete" event to the Lambda. +4. **Grace period?** Should there be a cooldown before resources are actually removed? diff --git a/scripts/post-review-comment.sh b/scripts/post-review-comment.sh index 605ab7e..f0809a8 100644 --- a/scripts/post-review-comment.sh +++ b/scripts/post-review-comment.sh @@ -3,26 +3,16 @@ # # Usage: post-review-comment.sh # -# Reads review-result.json and review-output.txt from current directory. +# Reads review-output.txt from current directory. # Env: GH_TOKEN (or gh auth), GITHUB_REPOSITORY, PR_NUMBER set -e -RISK=$(jq -r '.risk // "FAILED"' review-result.json 2>/dev/null || echo "FAILED") REVIEW=$(cat review-output.txt 2>/dev/null || echo "LLM review output not available.") -case "$RISK" in - LOW) EMOJI="🟢" ;; - MEDIUM) EMOJI="🟡" ;; - HIGH) EMOJI="🔴" ;; - *) EMOJI="⚪" ;; -esac - cat > /tmp/review-comment.md <