gabriel / musehub public
docs patch docs/staging-secrets-migrated #1 / 1
AI Agent gabriel · 3 days ago · Sep 7, 2026 · Diff

docs: staging secrets fully migrated to SSM, pipeline proven end-to-end (#156)

Found staging's instance role had zero SSM Parameter Store permissions (only agent connectivity + ECR pull) - deploy/secrets.sh would have failed even with all parameters populated. Fixed with a scoped read-only inline policy matching production's pattern.

Migrated the 4 missing parameters (DB_PASSWORD, BLOB_STORAGE_ACCESS_KEY_ID, BLOB_STORAGE_SECRET_ACCESS_KEY, RUNNER_TOKEN) entirely server-side - briefly granted the instance role write access, ran a script that read .env and wrote to SSM without any value ever appearing in tool output, then revoked write access immediately after.

Ran deploy/secrets.sh for real against staging - fetched all 7 parameters, wrote a fresh .env, passed its sanity check, confirmed staging still healthy. Staging and production now have an identical secrets pipeline.

sha256:86b2af2721c84871b4e57297545ec760c04b853f1dd55125573d0414e773fabe sha
sha256:1fdf616238f2ccb8158f5a3df1ca5f6b8b780c10a12a643a00619abda445b8a9 parent
+6 ~1 −4 symbols
1 changed · 1060 in snapshot files
sha256:335ff3e6c78756732e44f3afb5a084688f734b2422b24588a45269e3ea1be0a5 snapshot
+6
symbols added
~1
symbol modified
−4
symbols removed
1
file changed
1060
files in snapshot
0
dead code introduced
Semantic Changes 11 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/architecture/
+ docs/guides/
+ docs/issues/
+ docs/issues/assets/
+ docs/legal/
+ docs/mists/
+ docs/production-readiness/
+ docs/reference/
+ docs/releases/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/opengraph/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ docs/production-readiness/07-secrets-and-config.md .md 6 symbols added, 4 symbols removed, 1 symbol modified
− Checklist assessment section Checklist assessment L19–40
− md) section Full secrets inventory (corrected, see docs/infrastructure.md) L5–19
− table section table L7–15
− The actual work item here section The actual work item here L40–48
+ Checklist assessment — updated section Checklist assessment — updated L46–77
+ Remaining work section Remaining work L77–86
+ Update (2026-09-07) — staging SSM migration complete, pipeline proven end-to-end section Update (2026-09-07) — staging SSM migration complete, pipeline proven end-to-end L5–46
+ Full secrets inventory — now identical shape on both environments section Full secrets inventory — now identical shape on both environments L30–46
+ table section table L32–41
+ What was actually involved (more than just "add the parameters") section What was actually involved (more than just "add the parameters") L10–30
~ Section 7 — Secrets and Application Configuration
Files Changed
~1
1060 in snapshot
~ docs/production-readiness/07-secrets-and-config.md .md
← Older Oldest on docs/staging-secrets-migrated
All commits
Newer → Latest on docs/staging-secrets-migrated

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:86b2af2721c84871b4e57297545ec760c04b853f1dd55125573d0414e773fabe --body "your comment"