@deployfoundation/foundation-deploy 0.2.51 → 0.2.53

package/src/stacks/data-stack.ts

@@ -16,7 +16,8 @@ export interface FoundationDataProps extends cdk.StackProps {
  * FoundationData — the durable layer: one CMK, two S3 buckets (config +
  * skills, and channel documents), two always-present DynamoDB tables, an
  * optional CRM table, an optional proxy-only Upwork approval table, an optional
- * retained Upwork OAuth secret, and the Secrets Manager entries.
+ * retained Upwork OAuth secret, the optional key for a company's own CRM, and
+ * the Secrets Manager entries.
  * The two always-present DynamoDB tables use
  * different access patterns: `FoundationTable` is `pk` (S) only:
  * dedupe rows, the Codex credential lease and the thread→session index, every
@@ -53,6 +54,12 @@ export class FoundationData extends cdk.Stack {
   public readonly upworkApprovalTable?: dynamodb.Table;
   /** Short-lived OOB request-token state; gateway-only and destroyed with the opt-in. */
   public readonly etradePendingTable?: dynamodb.Table;
+  /**
+   * The `crm/1` key, present only with `crm.provider` kind `http`. Other stacks
+   * reach it by its fixed name, never through this object, so switching back to
+   * `dynamodb` can delete it without a cross-stack export holding it in place.
+   */
+  public readonly crmHttpSecret?: secretsmanager.Secret;
   public readonly secrets: {
     signing: secretsmanager.ISecret;
     slackApp: secretsmanager.ISecret;
@@ -230,6 +237,25 @@ export class FoundationData extends cdk.Stack {
         })
       : undefined;
 
+    // The key for a company's own CRM (`crm.provider` kind `http`): empty
+    // until `foundation-deploy crm-key` writes `{ api_key }`, and until then
+    // the CRM proxy answers `unconfigured`. Like the Otter key it is destroyed
+    // with the opt-in: a rollback to `dynamodb` must not strand a fixed-name
+    // secret that a later switch back to `http` could not create again, and
+    // the CRM issues a fresh key in seconds.
+    this.crmHttpSecret =
+      provisionsIntegration(props.instance, "crm") && props.instance.crm.provider.kind === "http"
+        ? new secretsmanager.Secret(this, "CrmHttpSecret", {
+            secretName: names.secretCrmHttp,
+            description: `crm/1 key for ${display}'s CRM ({ api_key }); written by foundation-deploy crm-key, read only by the CRM proxy`,
+            removalPolicy: cdk.RemovalPolicy.DESTROY,
+            generateSecretString: {
+              secretStringTemplate: "{}",
+              generateStringKey: "placeholder",
+            },
+          })
+        : undefined;
+
     // Unlike the disposable Otter API key, the Upwork OAuth secret carries
     // client credentials plus refresh state. Retaining it makes a deploy safe
     // and leaves manually entered client credentials intact.

package/src/stacks/secret-bearing-reads.ts

@@ -0,0 +1,131 @@
+/**
+ * Reads that AWS's `ReadOnlyAccess` grants whose RESPONSES carry secrets in
+ * plaintext: environment variables, user data, connection properties, request
+ * headers, issued tokens. Both shell-reachable agent roles deny every one of
+ * them (`FoundationAgent.secretBearingReadsPolicy`), so "read-only" never means
+ * "can read the credentials that write".
+ *
+ * Found 2026-10-26 in a company account: three Lambdas held a read-write
+ * MongoDB connection string in their environment, and sampled WAF requests
+ * held the web app's admin bearer tokens. Either one turned the read-only role
+ * into a write path.
+ *
+ * Judged against `ReadOnlyAccess` v190 (2026-09-24). The rule for adding an
+ * action: its response can contain a value someone typed in as configuration
+ * (env, user data, connection or job arguments, hosted config), a credential
+ * AWS mints for the caller, or another caller's request. Data-plane reads
+ * (S3 objects, DynamoDB items, queue messages, log events) are a different
+ * question, decided separately: see docs/capabilities/aws-readonly.md.
+ *
+ * What stays readable for diagnosis: CloudWatch Logs (Insights included),
+ * metrics, alarms, X-Ray, CloudTrail, every `Describe*`/`List*` not named here,
+ * stack events and outputs, SSM parameter NAMES, and Lambda's event source
+ * mappings, aliases, concurrency and policies.
+ *
+ * Every entry is an exact action name, never a wildcard, so a reviewer can
+ * check each one against the service authorization reference.
+ */
+export const SECRET_BEARING_READ_ACTIONS: readonly string[] = [
+  // WAF sampled requests return full request headers, Authorization included.
+  "wafv2:GetSampledRequests",
+  "waf:GetSampledRequests",
+  "waf-regional:GetSampledRequests",
+
+  // Lambda: function configuration includes `Environment.Variables`, and
+  // GetFunction / GetLayerVersion add a presigned code download URL. List
+  // calls return the same configuration for every function or version.
+  "lambda:GetFunction",
+  "lambda:GetFunctionConfiguration",
+  "lambda:ListFunctions",
+  "lambda:ListVersionsByFunction",
+  "lambda:GetLayerVersion",
+  "lambda:GetLayerVersionByArn",
+
+  // Container and build configuration: plaintext environment variables.
+  "ecs:DescribeTaskDefinition",
+  "apprunner:DescribeService",
+  "batch:DescribeJobDefinitions",
+  "batch:DescribeJobs",
+  "codebuild:BatchGetProjects",
+  "codebuild:BatchGetBuilds",
+  "codebuild:BatchGetBuildBatches",
+
+  // Amplify apps and branches carry environment variables and basic-auth
+  // credentials; backend environments carry deployment settings.
+  "amplify:GetApp",
+  "amplify:ListApps",
+  "amplify:GetBranch",
+  "amplify:ListBranches",
+  "amplify:GetBackendEnvironment",
+
+  // Elastic Beanstalk environment properties are its environment variables.
+  "elasticbeanstalk:DescribeConfigurationSettings",
+
+  // EC2 user data (instance attribute and launch template versions).
+  "ec2:DescribeLaunchTemplateVersions",
+  "ec2:DescribeInstanceAttribute",
+
+  // SSM parameter VALUES. Denied for plain String parameters too: teams
+  // store secrets as String by mistake, and with the account's default
+  // `aws/ssm` key a SecureString can decrypt through the same call.
+  // DescribeParameters (names, types, versions) stays readable.
+  "ssm:GetParameter",
+  "ssm:GetParameters",
+  "ssm:GetParametersByPath",
+  "ssm:GetParameterHistory",
+
+  // CloudFormation template bodies can hold literal secrets and parameter
+  // defaults. Denied: DescribeStacks, DescribeStackEvents and
+  // DescribeStackResources answer the diagnosis questions without them.
+  "cloudformation:GetTemplate",
+
+  // AppConfig hosted configuration content is application configuration.
+  "appconfig:GetConfiguration",
+  "appconfig:GetHostedConfigurationVersion",
+
+  // Glue job default arguments and connection properties (JDBC user and
+  // password when not in Secrets Manager); dev endpoints carry job arguments.
+  // v190 does not grant GetConnection(s); they are named anyway because AWS
+  // revises the policy without notice and these return the password.
+  "glue:GetJob",
+  "glue:GetJobs",
+  "glue:BatchGetJobs",
+  "glue:GetConnection",
+  "glue:GetConnections",
+  "glue:GetDevEndpoint",
+  "glue:GetDevEndpoints",
+  "glue:BatchGetDevEndpoints",
+
+  // SageMaker container `Environment` maps on models and jobs.
+  "sagemaker:DescribeModel",
+  "sagemaker:DescribeTrainingJob",
+  "sagemaker:DescribeProcessingJob",
+  "sagemaker:DescribeTransformJob",
+
+  // Data Pipeline definitions hold activity fields, database passwords included.
+  "datapipeline:GetPipelineDefinition",
+
+  // AppSync: API key values, and HTTP data source authorization config.
+  "appsync:ListApiKeys",
+  "appsync:GetDataSource",
+  "appsync:ListDataSources",
+
+  // Kinesis Data Analytics / Managed Flink environment properties.
+  "kinesisanalytics:DescribeApplication",
+
+  // Lightsail bucket access keys and container service environment.
+  "lightsail:GetBucketAccessKeys",
+  "lightsail:GetContainerServices",
+  "lightsail:GetContainerServiceDeployments",
+
+  // OpsWorks app environment variables and stack custom JSON.
+  "opsworks:DescribeApps",
+  "opsworks:DescribeStacks",
+
+  // Calls that MINT a credential rather than describe one.
+  "cognito-identity:GetCredentialsForIdentity",
+  "cognito-identity:GetOpenIdToken",
+  "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
+  "connect:GetFederationToken",
+  "codeartifact:GetAuthorizationToken",
+];