Add apply-gate Lambda for credential-brokered apply#22
Merged
Conversation
New security model: tf-apply no longer has direct infrastructure IAM permissions. Instead it invokes a gate Lambda that: - Reads risk.json from S3 (uploaded by plan-review) - If LOW/MEDIUM: issues temp STS credentials via AssumeRole - If HIGH: verifies HMAC-signed override token before issuing credentials - Signing key stays in SSM, only the Lambda can read it New resources: - javabin-apply-gate Lambda (credential broker) - javabin-ci-apply-gate OIDC role (can only invoke Lambda + read S3) - Updated ci-app roles: trust gate Lambda for apply, OIDC for plan only - Updated override-approver: invokes Lambda sign action instead of SSM write Flow: plan-review uploads risk.json → tf-apply calls gate → gate checks risk + override → returns temp credentials → apply runs with those creds Override: admin triggers approve-override.yml (GitHub environment protected) → Lambda signs HMAC token → writes override.json to S3 → retriggers apply
Alexanderamiri
force-pushed
the
feature/expander-ci-integration
branch
from
c7b1020 to
d47a173
Compare
Terraform PlanChanges detected — review required. Plan output |
LLM Plan ReviewRisk: 🟢 LOW Adding a new Lambda-based approval gate for Terraform apply operations with appropriate IAM controls and removing legacy SSM override permissions.
|
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary
- New `javabin-apply-gate` Lambda: credential broker that verifies risk
+ HMAC override before issuing temp STS credentials
- tf-apply no longer has direct infrastructure IAM — it gets credentials
from the gate Lambda
- New `javabin-ci-apply-gate` OIDC role: can only invoke Lambda + read
S3 (no infra permissions)
- plan-review uploads `risk.json` to S3 alongside the plan
- Override flow: admin triggers `approve-override.yml` (protected by
GitHub environment) → Lambda signs HMAC token → retriggers apply
- Removed old `risk_level` workflow input from tf-apply (reads from S3
via Lambda)
## Security model
```
tf-plan → uploads plan + plan-output to S3
review → uploads risk.json to S3
tf-apply → assumes lightweight OIDC role (Lambda invoke + S3 read only)
→ invokes gate Lambda with plan_key
→ Lambda reads risk.json, checks override if HIGH, verifies HMAC
→ Lambda assumes app CI role via STS, returns temp credentials
→ tf-apply uses temp credentials for terraform apply
```
## Test plan
- [ ] CI plan passes
- [ ] After merge+apply: create signing key in SSM
- [ ] Test LOW risk → auto-approve → credentials issued
- [ ] Test HIGH risk → blocked → Slack alert → override → retrigger →
succeeds
- [ ] Test tampered override.json → HMAC mismatch → blocked
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
javabin-apply-gateLambda: credential broker that verifies risk + HMAC override before issuing temp STS credentialsjavabin-ci-apply-gateOIDC role: can only invoke Lambda + read S3 (no infra permissions)risk.jsonto S3 alongside the planapprove-override.yml(protected by GitHub environment) → Lambda signs HMAC token → retriggers applyrisk_levelworkflow input from tf-apply (reads from S3 via Lambda)Security model
Test plan