gabriel / musehub public
docs docs/aws-identity-and-deploy-fixes #2 / 2
AI Agent gabriel · 3 days ago · Aug 28, 2026 · Diff

docs: reflect IAM Identity Center rollout, Aaron's access decision, and corrected prod-blocker status

- Document centralized root access management adoption: Nonproduction's root credentials deleted permanently by design, Management/Production keep standing root+MFA - Document Aaron's AdministratorAccess assignment (supersedes original scoped Operator + approval-gate plan, per his 50/50 LLC ownership) - Add sign-in quick reference distinguishing root vs SSO vs deleted-root access - Correct stale prod-deploy-blocker notes referencing the old pre-rebuild instance across production-readiness docs and the deploy runbook - Note Sol/Toby/Ben StagingOperator access remains intentionally deferred

sha256:c113f2514d5a96866ed11368012a3a7f63a27d412847692497fbf996720a06d9 sha
sha256:bba4b69de173366aeb7d490d687ccffb6db9726374033addece89cf2b87642d8 parent
+17 ~49 −13 symbols
6 changed · 1059 in snapshot files
sha256:823664daa65237f04293df33b8bafa47e81b03ae9762c8c0e8aa740516be53ed snapshot
+17
symbols added
~49
symbols modified
−13
symbols removed
6
files changed
1059
files in snapshot
0
dead code introduced
Semantic Changes 79 symbols
~ docs/architecture/musehub-cloud-identity-and-aws-operating-model.md .md 3 symbols added, 6 symbols modified
+ Sign-in quick reference section Sign-in quick reference L215–225
+ table section table L219–224
+ Centralized root access management section Centralized root access management L256–265
~ MuseHub Cloud Identity and AWS Account Operating Model
~ Security work completed
~ Remaining work
~ Security follow-up
~ Human AWS access procedure
~ Root mailbox and root-user model
~ docs/infrastructure.md .md 7 symbols added, 8 symbols removed, 34 symbols modified
~ code[bash]
~ code[bash]@L374
~ code[bash]@L380
~ code[bash]@L298
~ code[bash]@L316
− code[bash] variable variable code[bash] L449–453
− Costs (approximate, us-east-1, 2025 pricing) section Costs (approximate, us-east-1, 2025 pricing) L456–478
− table section table L458–465
− env) variable section Environment variables (.env on instance at /opt/musehub/.env) L107–119
− code variable variable code L109–118
− Instance access (SSM — no SSH) section Instance access (SSM — no SSH) L133–148
− code[bash] variable variable code[bash] L135–147
− SSL section SSL L128–133
+ Costs (approximate, us-east-1, 2026 pricing) section Costs (approximate, us-east-1, 2026 pricing) L555–582
+ table section table L557–566
+ Instance access (SSM — no SSH, no key pair exists) section Instance access (SSM — no SSH, no key pair exists) L189–205
+ code[bash] variable variable code[bash] L191–204
+ Secrets — AWS SSM Parameter Store (both environments now use this pipeline for the secret half) section Secrets — AWS SSM Parameter Store (both environments now use this pipeline for the secret half) L153–169
+ code[bash] variable variable code[bash] L164–168
+ TLS section TLS L179–189
~ MuseHub Cloud Infrastructure
~ Backups
~ Deployment Workflow
~ Emergency migration rollback (on instance via SSM)
~ code[bash]
~ Rollback
~ code[bash]
~ Standard deploy
~ code[bash]
~ Overview
~ table
~ Production Environment
~ ai) — hosted at Cloudflare, not Namecheap
~ table
~ Instance
~ code
~ Nginx config
~ Object storage — Cloudflare R2, not a local volume
~ table
~ Stack
~ code
~ Useful commands on the instance
~ code[bash]
~ Volumes
~ table
~ Secrets inventory
~ table
~ Shared AWS Resources
~ table
~ docs/production-readiness/03-identity-and-permissions.md .md 3 symbols modified
~ Section 3 — Identity, Authentication, and Permissions
~ What this section actually requires (not yet done)
~ Human Access
~ docs/production-readiness/10-11-automated-deployment.md .md 1 symbol added, 1 symbol removed, 1 symbol modified
− Reminder — prod deploy is currently broken regardless of automation section Reminder — prod deploy is currently broken regardless of automation L84–91
+ Update (2026-08-26) — prod deploy is fixed; automation itself is still deferred section Update (2026-08-26) — prod deploy is fixed; automation itself is still deferred L84–103
~ Sections 10 & 11 — Automated Staging and Production Deployment
~ docs/production-readiness/musehub-production-infrastructure-launch-todo.md .md 3 symbols added, 1 symbol removed, 4 symbols modified
− Phase 3 — Provision the production baseline section Phase 3 — Provision the production baseline L129–147
+ Phase 3 — Provision the production baseline ✅ complete (2026-08-24) section Phase 3 — Provision the production baseline ✅ complete (2026-08-24) L138–165
+ Targets (decided 2026-08-25, closing out readiness ticket #149) section Targets (decided 2026-08-25, closing out readiness ticket #149) L17–32
+ table section table L22–28
~ MuseHub Production Infrastructure Launch TODO
~ Decisions that must be resolved during discovery
~ Phase 2 — Decide the production design
~ Phase 4 — Deploy and validate before public DNS
~ docs/production-readiness/runbook-deploy-onboarding.md .md 3 symbols added, 3 symbols removed, 1 symbol modified
− Access tiers (decided 2026-08-08) section Access tiers (decided 2026-08-08) L9–17
− table section table L11–16
− Production deploy (Gabriel and Aaron only, once prod is actually fixed) section Production deploy (Gabriel and Aaron only, once prod is actually fixed) L49–61
+ Access tiers (decided 2026-08-08; Aaron's tier updated 2026-08-26) section Access tiers (decided 2026-08-08; Aaron's tier updated 2026-08-26) L9–17
+ table section table L11–16
+ Production deploy (Gabriel and Aaron only) section Production deploy (Gabriel and Aaron only) L49–66
~ Deploy Runbook — Team Onboarding
Files Changed
~6
1059 in snapshot
~ docs/architecture/musehub-cloud-identity-and-aws-operating-model.md .md
~ docs/infrastructure.md .md
~ docs/production-readiness/03-identity-and-permissions.md .md
~ docs/production-readiness/10-11-automated-deployment.md .md
~ docs/production-readiness/musehub-production-infrastructure-launch-todo.md .md
~ docs/production-readiness/runbook-deploy-onboarding.md .md
← Older Oldest on docs/aws-identity-and-deploy-fixes
All commits Newer Merge staging/dev into docs/aws-identity-and-deploy-fixes sha256:6539fa9ad928cffb30a447da0c47c5bc0c95b5f1c4d60a25a806034f14043e16

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:c113f2514d5a96866ed11368012a3a7f63a27d412847692497fbf996720a06d9 --body "your comment"