Section 3 — Identity, Authentication, and Permissions

Companion to musehub-production-readiness-checklist.md.

Update (2026-09-07) — re-verified with full account access

Every blocked check from the original pass is now runnable. Re-ran all of them.

Root and Recovery Access

• [x] No root access keys — AccountAccessKeysPresent: 0 confirmed on both Nonproduction and Production via aws iam get-account-summary.
• [x] Root MFA — enabled on Management and Production (Authenticator, unique passwords). Nonproduction correctly shows AccountMFAEnabled: 0 because it has no standing root credential at all (centralized root access management) — not a gap, the intended end state. See the identity model doc for the full reasoning.
• [ ] Documented legitimate root uses, multi-person root approval — still not formally written down anywhere as a policy, even though the mechanism (centralized root access management) that would enforce it now exists.

Human Access

• [x] IAM Identity Center (MuseHub-Workforce) confirmed live via aws sso-admin list-instances — ACTIVE, owned by the Management account, created 2026-08-21.
• [x] Gabriel and Aaron have individual identities, MFA, and AdministratorAccess on all three accounts (superseding the original scoped Operator plan — Gabriel's deliberate decision, see #150/#152 history).
• [ ] Sol/Toby/Ben's StagingOperator access — still intentionally deferred, no active need yet.

Workload Access — full IAM inventory (previously impossible; iam:ListUsers was denied)

Nonproduction has 5 IAM users (Production has 0, by design):

• [x] Every service has its own IAM user, confirmed — no shared workload credential across services (this was already true, now fully verified rather than inferred).
• [ ] AWS keys in source code — still confirmed clean (no keys committed); moot for GitHub secrets since GitHub isn't used for CI here.
• [ ] Deployment role restricted to correct repo/branch/account/resources — not applicable; no automated (CI-triggered) deployment role exists at all yet (see #173 roadmap item).
• [x] Separate staging/production deployment auth — resolved as of #150: push.sh uses each operator's own SSO session per environment, not a single shared credential across both.
• [ ] Temporary/STS credentials everywhere — still not done for the workload IAM users above; all four remaining users have long-lived static access keys, none rotated since creation.

The actual work items here — updated

1. Get the broader read-access grant — done.
2. Set up IAM Identity Center — done.
3. Replace the shared musehub-infra laptop credential for human deploys — done (#150).
4. New, from today's inventory: decide what to do with stori-admin's full admin access — needs a conversation with whoever manages Stori's AWS access, not something to resolve unilaterally from here.
5. New, from today's inventory: rotate or move to STS-issued temporary credentials for musehub-infra, musehub-app, and stori-assets-app — all have long-lived static keys, some over 7 months old with no rotation.
6. Retire musehub-infra fully once the other scripts that still reference it are updated (#175).