gabriel / musehub public
Closed #150 Question production-readiness
filed by gabriel human · 68 days ago

Production readiness — Section 1: Ownership and Shared Access

0 Anchors
— Blast radius
— Churn 30d
0 Proposals

Full detail

aaronrene already has write collaborator access on musehub and muse repos. Everything else (AWS/Namecheap/Cloudflare ownership, recovery paths, break-glass procedure) needs Gabriel — requires AWS/Namecheap console access this environment does not have.

Key risk: deploys currently use a single shared AWS credential (musehub-infra), not individual identities. Aaron has no independent AWS identity yet — blocks the checklist's explicit "test that Aaron can operate independently" requirement.

◎ Activity2
●
gabriel opened this issue 68 days ago
○
gabriel 68 days ago

Scope update: deploy team expanded from 2 (Gabriel, Aaron) to 5 (+ interns Sol, Toby, Ben). Interns are staging-only by design. New runbook covering this: docs/production-readiness/runbook-deploy-onboarding.md. Interim: the current shared musehub-infra AWS credential should NOT be handed to interns before Section 3 ships individual identities.

○
gabriel 38 days ago

Re-verified with full account access — most of this section is now resolved.

Resolved:

  • IAM Identity Center + individual SSO identities for Gabriel and Aaron, each with MFA
  • Aaron has AdministratorAccess on all three AWS accounts, matching his 50/50 ownership
  • Root MFA on Management/Production; Nonproduction's root deliberately has no standing credential (centralized break-glass instead)
  • Company-controlled AWS root mailboxes (Google Groups on the company domain)
  • No more shared credential for deploys — push.sh now uses individual SSO for both staging and production; verified live with a real staging deploy under Aaron's/Gabriel's own identity, zero reliance on musehub-infra
  • Aaron upgraded from write to admin collaborator on musehub and muse
  • Joiner/leaver procedure documented (identity model doc §11/§12)
  • AWS break-glass procedure exists (centralized root access management)

Independent-operation test — 6 of 7 capabilities now genuinely true (sign-in, inspect prod, deploy staging, deploy/approve prod, inspect logs, restore backup). DNS/Cloudflare access is the one still-unverified capability.

Still open, split to #175: musehub-infra still referenced in a few other deploy scripts, Namecheap/Cloudflare ownership confirmation, Aaron's DNS access, quarterly access review cadence, per-area ownership recording (DNS/DB/incident-response/billing still default to Gabriel alone).

Closing — the core identity/access architecture this section was blocked on is done.

✓
closed this issue 38 days ago