gabriel / musehub public
03-identity-and-permissions.md markdown
64 lines 4.8 KB
Raw
sha256:717d4b3ac0bd942892746314525e570495d7db6b166dbdb7da00ee3d6e8da35c docs: re-verify Section 3 identity/permissions with full ac… Sonnet 5 patch 1 day ago

Section 3 — Identity, Authentication, and Permissions

Companion to musehub-production-readiness-checklist.md.

Update (2026-09-07) — re-verified with full account access

Every blocked check from the original pass is now runnable. Re-ran all of them.

Root and Recovery Access

  • [x] No root access keys — AccountAccessKeysPresent: 0 confirmed on both Nonproduction and Production via aws iam get-account-summary.
  • [x] Root MFA — enabled on Management and Production (Authenticator, unique passwords). Nonproduction correctly shows AccountMFAEnabled: 0 because it has no standing root credential at all (centralized root access management) — not a gap, the intended end state. See the identity model doc for the full reasoning.
  • [ ] Documented legitimate root uses, multi-person root approval — still not formally written down anywhere as a policy, even though the mechanism (centralized root access management) that would enforce it now exists.

Human Access

  • [x] IAM Identity Center (MuseHub-Workforce) confirmed live via aws sso-admin list-instances — ACTIVE, owned by the Management account, created 2026-08-21.
  • [x] Gabriel and Aaron have individual identities, MFA, and AdministratorAccess on all three accounts (superseding the original scoped Operator plan — Gabriel's deliberate decision, see #150/#152 history).
  • [ ] Sol/Toby/Ben's StagingOperator access — still intentionally deferred, no active need yet.

Workload Access — full IAM inventory (previously impossible; iam:ListUsers was denied)

Nonproduction has 5 IAM users (Production has 0, by design):

User Policies Key age Key status Notes
musehub-infra AmazonSSMFullAccess, AmazonEC2FullAccess, AmazonRDSFullAccess, AmazonS3FullAccess + inline musehub-ecr-push since 2026-04-05 Active No longer used by push.sh (see #150) — still exists as a live, usable credential. Broader than previously documented; not narrowly scoped as the original pass assumed.
musehub-app AmazonRDSDataFullAccess, AmazonS3FullAccess since 2026-04-05 Active App-level DB+storage access, reasonably scoped to its role
stori-assets-app AmazonEC2FullAccess, AmazonS3FullAccess + inline stori-assets-s3-read since 2026-01-30 Active EC2FullAccess is broader than an "assets app" name suggests — worth Stori-side confirmation of what it actually needs
stori-admin AdministratorAccess (full account) since 2026-01-29 Active Real risk — full admin access to the entire shared Nonproduction account via a static, unrotated key, for an unrelated project. Flagged to Gabriel 2026-09-07; deliberately not touched, since it's Stori's credential and modifying/deleting it without checking with whoever manages Stori's access could break their operations. Tracked in follow-up.
s3-migration-temp AmazonS3FullAccess — — Deleted 2026-09-07 — access key was already inactive, clearly dead weight from a past migration. Removed entirely (key detached, policy detached, user deleted).
  • [x] Every service has its own IAM user, confirmed — no shared workload credential across services (this was already true, now fully verified rather than inferred).
  • [ ] AWS keys in source code — still confirmed clean (no keys committed); moot for GitHub secrets since GitHub isn't used for CI here.
  • [ ] Deployment role restricted to correct repo/branch/account/resources — not applicable; no automated (CI-triggered) deployment role exists at all yet (see #173 roadmap item).
  • [x] Separate staging/production deployment auth — resolved as of #150: push.sh uses each operator's own SSO session per environment, not a single shared credential across both.
  • [ ] Temporary/STS credentials everywhere — still not done for the workload IAM users above; all four remaining users have long-lived static access keys, none rotated since creation.

The actual work items here — updated

  1. Get the broader read-access grant — done.
  2. Set up IAM Identity Center — done.
  3. Replace the shared musehub-infra laptop credential for human deploys — done (#150).
  4. New, from today's inventory: decide what to do with stori-admin's full admin access — needs a conversation with whoever manages Stori's AWS access, not something to resolve unilaterally from here.
  5. New, from today's inventory: rotate or move to STS-issued temporary credentials for musehub-infra, musehub-app, and stori-assets-app — all have long-lived static keys, some over 7 months old with no rotation.
  6. Retire musehub-infra fully once the other scripts that still reference it are updated (#175).
File History 1 commit
sha256:717d4b3ac0bd942892746314525e570495d7db6b166dbdb7da00ee3d6e8da35c docs: re-verify Section 3 identity/permissions with full ac… Sonnet 5 patch 1 day ago