@deployfoundation/foundation-deploy 0.2.52 → 0.2.54

package/dist/bin/app.js

@@ -8,7 +8,7 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-59dpqyap.js";
+} from "../chunk-tfn9tvaa.js";
 import"../chunk-pxhftba1.js";
 import"../chunk-dz91avrb.js";
 import {
@@ -16,7 +16,7 @@ import {
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-rxetj2p9.js";
+} from "../chunk-fjdgxw8h.js";
 import"../chunk-96fjaysn.js";
 import"../chunk-5wgwscd0.js";
 

package/dist/bin/foundation-deploy.js

@@ -32,13 +32,14 @@ import {
   secretExists,
   stackExists,
   stackOutput
-} from "../chunk-9zx95xs6.js";
+} from "../chunk-nvsj7bbw.js";
 import {
   CUSTOMIZATION_ARTIFACT_NAME,
   instanceNames,
+  mongoCollectionPolicyEnv,
   slackCommandPrefix,
   versionedConfigKey
-} from "../chunk-rxetj2p9.js";
+} from "../chunk-fjdgxw8h.js";
 import"../chunk-m76jt5rc.js";
 import"../chunk-3614v9rr.js";
 import {
@@ -1216,6 +1217,7 @@ function composeRuntimeSecret(inputs) {
     ...inputs.etradeProxyFunctionArn !== undefined && inputs.etradeProxyFunctionArn !== "" ? { FOUNDATION_ETRADE_PROXY_ARN: inputs.etradeProxyFunctionArn } : {},
     ...inputs.routineIngressFunctionArn !== undefined && inputs.routineIngressFunctionArn !== "" ? { FOUNDATION_ROUTINE_INGRESS_FUNCTION_ARN: inputs.routineIngressFunctionArn } : {},
     FOUNDATION_MONGODB_SECRET_ID: names.secretMongodbReadonly,
+    ...instance.mongodbReadonly.deniedCollections.length > 0 || instance.mongodbReadonly.unsafeReadDefaultDeniedCollections.length > 0 ? { FOUNDATION_MONGODB_COLLECTION_POLICY: mongoCollectionPolicyEnv(instance.mongodbReadonly) } : {},
     FOUNDATION_SLACK_TEAM_ID: slackApp.team_id !== undefined && slackApp.team_id !== "" ? slackApp.team_id : instance.slack.teamId
   };
 }
@@ -2538,7 +2540,7 @@ ${USAGE}`);
     const tenantId = flag2(args, "--tenant");
     if (baseUrl === undefined || tenantId === undefined || !args.includes("--key-stdin"))
       throw new Error("crm-check --base-url needs --tenant <id> and --key-stdin");
-    const { crmCheckTarget, defaultCrmCommandDeps } = await import("../chunk-sgdcmme0.js");
+    const { crmCheckTarget, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
     return crmCheckTarget({
       baseUrl,
       tenantId,
@@ -2611,21 +2613,21 @@ ${USAGE}`);
       return 0;
     }
     case "crm-key": {
-      const { crmKey, defaultCrmCommandDeps } = await import("../chunk-sgdcmme0.js");
+      const { crmKey, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
       await crmKey(ctx, { stdin: args.includes("--stdin") }, defaultCrmCommandDeps());
       return 0;
     }
     case "crm-check": {
       if (args.includes("--write"))
         throw new Error("crm-check --write creates records and spends the week's outreach allowance, so it never runs against the instance's own tenant: use --base-url with a sandbox tenant");
-      const { crmCheck, defaultCrmCommandDeps } = await import("../chunk-sgdcmme0.js");
+      const { crmCheck, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
       return crmCheck(ctx, { allowSkips: args.includes("--allow-skips") }, defaultCrmCommandDeps());
     }
     case "crm-replay": {
       const from = flag2(args, "--from");
       if (from === undefined || from.startsWith("-"))
         throw new Error("crm-replay needs --from <file>: the writes to replay, as JSONL");
-      const { crmReplay, defaultCrmCommandDeps } = await import("../chunk-sgdcmme0.js");
+      const { crmReplay, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
       const result = await crmReplay(ctx, { from }, defaultCrmCommandDeps());
       return result.refused.length > 0 ? 1 : 0;
     }

package/dist/{chunk-sgdcmme0.js → chunk-1pww63wd.js}

@@ -3,8 +3,8 @@ import {
   putSecretString,
   readSecretString,
   secretExists
-} from "./chunk-9zx95xs6.js";
-import"./chunk-rxetj2p9.js";
+} from "./chunk-nvsj7bbw.js";
+import"./chunk-fjdgxw8h.js";
 import {
   CrmIdempotencyConflictError,
   CrmRecordNotFoundError

package/dist/{chunk-rxetj2p9.js → chunk-fjdgxw8h.js}

@@ -7,6 +7,34 @@ import {
 // ../core/src/instance.ts
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
+
+// ../core/src/mongodb-collections.ts
+var DEFAULT_DENIED_MONGO_COLLECTIONS = [
+  "users",
+  "sessions",
+  "refreshtokens",
+  "passwordresets",
+  "servicekeys",
+  "machineapirequests",
+  "apikeys",
+  "oauthtokens",
+  "integrationtokens",
+  "integrations"
+];
+var DENIED_MONGO_COLLECTION_PATTERN = /token|secret|session|credential|password/i;
+function deniedByDefault(name) {
+  const lower = name.toLowerCase();
+  return DEFAULT_DENIED_MONGO_COLLECTIONS.includes(lower) || DENIED_MONGO_COLLECTION_PATTERN.test(lower);
+}
+function mongoCollectionPolicyEnv(section) {
+  const policy = {
+    denied: section.deniedCollections.map((name) => name.toLowerCase()),
+    unsafeAllowed: section.unsafeReadDefaultDeniedCollections.map((name) => name.toLowerCase())
+  };
+  return JSON.stringify(policy);
+}
+
+// ../core/src/instance.ts
 var PENDING = "TBD";
 var CUSTOMIZATION_ARTIFACT_NAME = "Customization";
 var RawAws = z.object({
@@ -234,6 +262,27 @@ var RawCrmProvider = z.discriminatedUnion("kind", [
   }).strict()
 ]);
 var RawCrm = z.object({ provider: RawCrmProvider.default({ kind: "dynamodb" }) }).strict().default({});
+var MongoCollectionName = z.string().regex(/^[A-Za-z0-9_.$-]{1,120}$/, "a MongoDB collection name, e.g. auditlogs");
+var RawMongodbReadonly = z.object({
+  deniedCollections: z.array(MongoCollectionName).max(200).default([]),
+  unsafeReadDefaultDeniedCollections: z.array(MongoCollectionName).max(50).default([])
+}).strict().superRefine((section, ctx) => {
+  const denied = new Set(section.deniedCollections.map((name) => name.toLowerCase()));
+  section.unsafeReadDefaultDeniedCollections.forEach((name, index) => {
+    if (denied.has(name.toLowerCase()))
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["unsafeReadDefaultDeniedCollections", index],
+        message: `${name} is in deniedCollections too; remove it from one list`
+      });
+    else if (!deniedByDefault(name))
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["unsafeReadDefaultDeniedCollections", index],
+        message: `${name} is not denied by default, so there is nothing to opt out of`
+      });
+  });
+}).default({});
 var RawInstance = z.object({
   name: z.string().min(1).max(63).regex(/^[a-z][a-z0-9-]*$/),
   displayName: z.string().min(1).max(120),
@@ -252,7 +301,8 @@ var RawInstance = z.object({
   integrations: RawIntegrations,
   newsletter: RawNewsletter,
   pages: RawPages,
-  crm: RawCrm
+  crm: RawCrm,
+  mongodbReadonly: RawMongodbReadonly
 }).strict().superRefine((doc, ctx) => {
   if (doc.crm.provider.kind === "http" && !doc.integrations.crm)
     ctx.addIssue({
@@ -463,4 +513,4 @@ var WEB_SEARCH_TARGET = "websearch";
 var WEB_SEARCH_CONNECTOR_VERSION = "1.2.0";
 var LIVE_ENDPOINT_NAME = "live";
 
-export { CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME };
+export { mongoCollectionPolicyEnv, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME };

package/dist/{chunk-9zx95xs6.js → chunk-nvsj7bbw.js}

@@ -1,7 +1,7 @@
 import {
   instanceNames,
   loadInstanceFile
-} from "./chunk-rxetj2p9.js";
+} from "./chunk-fjdgxw8h.js";
 
 // src/deploy/aws.ts
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";

package/dist/{chunk-59dpqyap.js → chunk-tfn9tvaa.js}

@@ -17,7 +17,7 @@ import {
   provisionsIntegration,
   requiresAuthenticatedQueue,
   slackCommandPrefixes
-} from "./chunk-rxetj2p9.js";
+} from "./chunk-fjdgxw8h.js";
 import {
   capabilityScheduledJobs,
   crmOutreachConfigured,
@@ -35,6 +35,70 @@ import * as cdk from "aws-cdk-lib";
 import * as ecr from "aws-cdk-lib/aws-ecr";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as logs from "aws-cdk-lib/aws-logs";
+
+// src/stacks/secret-bearing-reads.ts
+var SECRET_BEARING_READ_ACTIONS = [
+  "wafv2:GetSampledRequests",
+  "waf:GetSampledRequests",
+  "waf-regional:GetSampledRequests",
+  "lambda:GetFunction",
+  "lambda:GetFunctionConfiguration",
+  "lambda:ListFunctions",
+  "lambda:ListVersionsByFunction",
+  "lambda:GetLayerVersion",
+  "lambda:GetLayerVersionByArn",
+  "ecs:DescribeTaskDefinition",
+  "apprunner:DescribeService",
+  "batch:DescribeJobDefinitions",
+  "batch:DescribeJobs",
+  "codebuild:BatchGetProjects",
+  "codebuild:BatchGetBuilds",
+  "codebuild:BatchGetBuildBatches",
+  "amplify:GetApp",
+  "amplify:ListApps",
+  "amplify:GetBranch",
+  "amplify:ListBranches",
+  "amplify:GetBackendEnvironment",
+  "elasticbeanstalk:DescribeConfigurationSettings",
+  "ec2:DescribeLaunchTemplateVersions",
+  "ec2:DescribeInstanceAttribute",
+  "ssm:GetParameter",
+  "ssm:GetParameters",
+  "ssm:GetParametersByPath",
+  "ssm:GetParameterHistory",
+  "cloudformation:GetTemplate",
+  "appconfig:GetConfiguration",
+  "appconfig:GetHostedConfigurationVersion",
+  "glue:GetJob",
+  "glue:GetJobs",
+  "glue:BatchGetJobs",
+  "glue:GetConnection",
+  "glue:GetConnections",
+  "glue:GetDevEndpoint",
+  "glue:GetDevEndpoints",
+  "glue:BatchGetDevEndpoints",
+  "sagemaker:DescribeModel",
+  "sagemaker:DescribeTrainingJob",
+  "sagemaker:DescribeProcessingJob",
+  "sagemaker:DescribeTransformJob",
+  "datapipeline:GetPipelineDefinition",
+  "appsync:ListApiKeys",
+  "appsync:GetDataSource",
+  "appsync:ListDataSources",
+  "kinesisanalytics:DescribeApplication",
+  "lightsail:GetBucketAccessKeys",
+  "lightsail:GetContainerServices",
+  "lightsail:GetContainerServiceDeployments",
+  "opsworks:DescribeApps",
+  "opsworks:DescribeStacks",
+  "cognito-identity:GetCredentialsForIdentity",
+  "cognito-identity:GetOpenIdToken",
+  "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
+  "connect:GetFederationToken",
+  "codeartifact:GetAuthorizationToken"
+];
+
+// src/stacks/agent-stack.ts
 class FoundationAgent extends cdk.Stack {
   repository;
   executionRole;
@@ -77,6 +141,7 @@ class FoundationAgent extends cdk.Stack {
     this.accessPoint = accessPoint;
     this.executionRole = this.buildExecutionRole(props);
     this.readOnlyRole = this.buildReadOnlyRole(props);
+    this.secretBearingReadsPolicy(props.instance, [this.executionRole, this.readOnlyRole]);
     this.buildSpansIngestionPolicy();
     const gateway = this.buildToolGateway(display);
     this.webSearchUrl = gateway.getAtt("GatewayUrl").toString();
@@ -439,6 +504,20 @@ class FoundationAgent extends cdk.Stack {
     }));
     return role;
   }
+  secretBearingReadsPolicy(instance, roles) {
+    new iam.ManagedPolicy(this, "AgentSecretBearingReadsDeny", {
+      description: `${instance.displayName} agent: no AWS read whose response carries a secret`,
+      roles,
+      statements: [
+        new iam.PolicyStatement({
+          sid: "DenySecretBearingReads",
+          effect: iam.Effect.DENY,
+          actions: [...SECRET_BEARING_READ_ACTIONS],
+          resources: ["*"]
+        })
+      ]
+    });
+  }
   buildSpansIngestionPolicy() {
     return new logs.ResourcePolicy(this, "AgentSpansIngestion", {
       resourcePolicyName: `${this.stackName}-AgentSpansFromXray`,
@@ -2657,6 +2736,13 @@ class FoundationNetwork extends cdk5.Stack {
         actions: ["s3:GetObject"],
         resources: [`arn:${this.partition}:s3:::prod-${this.region}-starport-layer-bucket/*`]
       }));
+      s3Endpoint.addToPolicy(new iam6.PolicyStatement({
+        sid: "AmplifyArtifactsBucket",
+        effect: iam6.Effect.ALLOW,
+        principals: [new iam6.AnyPrincipal],
+        actions: ["s3:GetObject"],
+        resources: [`arn:${this.partition}:s3:::aws-amplify-prod-${this.region}-artifacts/*`]
+      }));
     }
     if (!skipEndpoints.has("dynamodb")) {
       const dynamoEndpoint = this.vpc.addGatewayEndpoint("DynamoDbEndpoint", {

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-59dpqyap.js";
+} from "../chunk-tfn9tvaa.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -47,7 +47,7 @@ import {
   loadInstanceFile,
   provisionsIntegration,
   requiresAuthenticatedQueue
-} from "../chunk-rxetj2p9.js";
+} from "../chunk-fjdgxw8h.js";
 import"../chunk-96fjaysn.js";
 import"../chunk-5wgwscd0.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.52",
+  "version": "0.2.54",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/runtime-secret.ts

@@ -12,6 +12,7 @@ import {
   instanceNames as namesFor,
   slackCommandPrefix,
 } from "@deployfoundation/foundation-core/instance";
+import { mongoCollectionPolicyEnv } from "@deployfoundation/foundation-core/mongodb-collections";
 
 /** The pinned AgentCore endpoint a deploy promotes and the invoker calls. */
 export const LIVE_ENDPOINT = "live";
@@ -258,6 +259,14 @@ export function composeRuntimeSecret(inputs: RuntimeSecretInputs): Record<string
     // LAZILY, so a secret still holding the CDK placeholder costs nothing
     // until someone asks a MongoDB question.
     FOUNDATION_MONGODB_SECRET_ID: names.secretMongodbReadonly,
+    // Collections the MongoDB tools refuse beyond the compiled-in defaults,
+    // from the instance file and never from config.yaml, so only a reviewed
+    // deploy changes it. Absent when the instance file adds nothing: the
+    // defaults hold without it.
+    ...(instance.mongodbReadonly.deniedCollections.length > 0 ||
+    instance.mongodbReadonly.unsafeReadDefaultDeniedCollections.length > 0
+      ? { FOUNDATION_MONGODB_COLLECTION_POLICY: mongoCollectionPolicyEnv(instance.mongodbReadonly) }
+      : {}),
     // CRM storage, the Otter credential, the Knock OAuth secrets, and the
     // Upwork/E*TRADE OAuth secrets are intentionally absent here: the
     // shell-capable agent receives only their fixed proxy ARNs.

package/src/stacks/agent-stack.ts

@@ -23,6 +23,7 @@ import {
   provisionsIntegration,
   requiresAuthenticatedQueue,
 } from "../names.ts";
+import { SECRET_BEARING_READ_ACTIONS } from "./secret-bearing-reads.ts";
 
 export interface FoundationAgentProps extends cdk.StackProps {
   /** The deployment this stack belongs to; every name below comes from it. */
@@ -154,6 +155,7 @@ export class FoundationAgent extends cdk.Stack {
     this.accessPoint = accessPoint;
     this.executionRole = this.buildExecutionRole(props);
     this.readOnlyRole = this.buildReadOnlyRole(props);
+    this.secretBearingReadsPolicy(props.instance, [this.executionRole, this.readOnlyRole]);
     this.buildSpansIngestionPolicy();
 
     // The gateway is independent of the runtime: it can (and does) exist
@@ -637,6 +639,8 @@ export class FoundationAgent extends cdk.Stack {
    * `ReadOnlyAccess` is AWS's own managed read-only policy. The inline
    * additions are the two things it does NOT cover which the observability
    * tools need: starting a Logs Insights query, and reading trace summaries.
+   * What it covers but must not, the reads whose responses carry secrets,
+   * is denied by `secretBearingReadsPolicy`.
    */
   private buildReadOnlyRole(props: FoundationAgentProps): iam.Role {
     const role = new iam.Role(this, "AgentReadOnlyRole", {
@@ -709,6 +713,36 @@ export class FoundationAgent extends cdk.Stack {
     return role;
   }
 
+  /**
+   * `ReadOnlyAccess` reads that return secrets: Lambda and container
+   * environment variables, user data, job and connection arguments, sampled
+   * WAF request headers, minted tokens ({@link SECRET_BEARING_READ_ACTIONS}).
+   *
+   * Both shell-reachable roles carry the deny. The read-only role needs it
+   * today, since its managed policy grants every one of these. The execution
+   * role grants none of them, and it gets the deny anyway for the same reason
+   * as the secret denies above: no future broad grant may reopen them.
+   *
+   * A managed policy of its own, like the pages policy, because the execution
+   * role's inline policy is near IAM's size limit. `Resource: "*"` because
+   * the point is every function, project and parameter in the account, not
+   * the instance's own.
+   */
+  private secretBearingReadsPolicy(instance: Instance, roles: iam.IRole[]): void {
+    new iam.ManagedPolicy(this, "AgentSecretBearingReadsDeny", {
+      description: `${instance.displayName} agent: no AWS read whose response carries a secret`,
+      roles,
+      statements: [
+        new iam.PolicyStatement({
+          sid: "DenySecretBearingReads",
+          effect: iam.Effect.DENY,
+          actions: [...SECRET_BEARING_READ_ACTIONS],
+          resources: ["*"],
+        }),
+      ],
+    });
+  }
+
   /**
    * Let X-Ray write this runtime's spans into the runtime's own log group.
    *

package/src/stacks/network-stack.ts

@@ -247,6 +247,21 @@ export class FoundationNetwork extends cdk.Stack {
           resources: [`arn:${this.partition}:s3:::prod-${this.region}-starport-layer-bucket/*`],
         }),
       );
+      // Amplify serves build and deploy logs the same way: `amplify:GetJob`
+      // returns a URL presigned by Amplify into an AWS-owned bucket, so the
+      // same-account rule refused it with 403. Olivia then could not read why
+      // GrowLab's frontend build failed and asked for the error 19 times while
+      // a Node-version break kept every release out of production
+      // (2026-10-26). Read-only, and only that bucket's objects.
+      s3Endpoint.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "AmplifyArtifactsBucket",
+          effect: iam.Effect.ALLOW,
+          principals: [new iam.AnyPrincipal()],
+          actions: ["s3:GetObject"],
+          resources: [`arn:${this.partition}:s3:::aws-amplify-prod-${this.region}-artifacts/*`],
+        }),
+      );
     }
     if (!skipEndpoints.has("dynamodb")) {
       const dynamoEndpoint = this.vpc.addGatewayEndpoint("DynamoDbEndpoint", {

package/src/stacks/secret-bearing-reads.ts

@@ -0,0 +1,131 @@
+/**
+ * Reads that AWS's `ReadOnlyAccess` grants whose RESPONSES carry secrets in
+ * plaintext: environment variables, user data, connection properties, request
+ * headers, issued tokens. Both shell-reachable agent roles deny every one of
+ * them (`FoundationAgent.secretBearingReadsPolicy`), so "read-only" never means
+ * "can read the credentials that write".
+ *
+ * Found 2026-10-26 in a company account: three Lambdas held a read-write
+ * MongoDB connection string in their environment, and sampled WAF requests
+ * held the web app's admin bearer tokens. Either one turned the read-only role
+ * into a write path.
+ *
+ * Judged against `ReadOnlyAccess` v190 (2026-09-24). The rule for adding an
+ * action: its response can contain a value someone typed in as configuration
+ * (env, user data, connection or job arguments, hosted config), a credential
+ * AWS mints for the caller, or another caller's request. Data-plane reads
+ * (S3 objects, DynamoDB items, queue messages, log events) are a different
+ * question, decided separately: see docs/capabilities/aws-readonly.md.
+ *
+ * What stays readable for diagnosis: CloudWatch Logs (Insights included),
+ * metrics, alarms, X-Ray, CloudTrail, every `Describe*`/`List*` not named here,
+ * stack events and outputs, SSM parameter NAMES, and Lambda's event source
+ * mappings, aliases, concurrency and policies.
+ *
+ * Every entry is an exact action name, never a wildcard, so a reviewer can
+ * check each one against the service authorization reference.
+ */
+export const SECRET_BEARING_READ_ACTIONS: readonly string[] = [
+  // WAF sampled requests return full request headers, Authorization included.
+  "wafv2:GetSampledRequests",
+  "waf:GetSampledRequests",
+  "waf-regional:GetSampledRequests",
+
+  // Lambda: function configuration includes `Environment.Variables`, and
+  // GetFunction / GetLayerVersion add a presigned code download URL. List
+  // calls return the same configuration for every function or version.
+  "lambda:GetFunction",
+  "lambda:GetFunctionConfiguration",
+  "lambda:ListFunctions",
+  "lambda:ListVersionsByFunction",
+  "lambda:GetLayerVersion",
+  "lambda:GetLayerVersionByArn",
+
+  // Container and build configuration: plaintext environment variables.
+  "ecs:DescribeTaskDefinition",
+  "apprunner:DescribeService",
+  "batch:DescribeJobDefinitions",
+  "batch:DescribeJobs",
+  "codebuild:BatchGetProjects",
+  "codebuild:BatchGetBuilds",
+  "codebuild:BatchGetBuildBatches",
+
+  // Amplify apps and branches carry environment variables and basic-auth
+  // credentials; backend environments carry deployment settings.
+  "amplify:GetApp",
+  "amplify:ListApps",
+  "amplify:GetBranch",
+  "amplify:ListBranches",
+  "amplify:GetBackendEnvironment",
+
+  // Elastic Beanstalk environment properties are its environment variables.
+  "elasticbeanstalk:DescribeConfigurationSettings",
+
+  // EC2 user data (instance attribute and launch template versions).
+  "ec2:DescribeLaunchTemplateVersions",
+  "ec2:DescribeInstanceAttribute",
+
+  // SSM parameter VALUES. Denied for plain String parameters too: teams
+  // store secrets as String by mistake, and with the account's default
+  // `aws/ssm` key a SecureString can decrypt through the same call.
+  // DescribeParameters (names, types, versions) stays readable.
+  "ssm:GetParameter",
+  "ssm:GetParameters",
+  "ssm:GetParametersByPath",
+  "ssm:GetParameterHistory",
+
+  // CloudFormation template bodies can hold literal secrets and parameter
+  // defaults. Denied: DescribeStacks, DescribeStackEvents and
+  // DescribeStackResources answer the diagnosis questions without them.
+  "cloudformation:GetTemplate",
+
+  // AppConfig hosted configuration content is application configuration.
+  "appconfig:GetConfiguration",
+  "appconfig:GetHostedConfigurationVersion",
+
+  // Glue job default arguments and connection properties (JDBC user and
+  // password when not in Secrets Manager); dev endpoints carry job arguments.
+  // v190 does not grant GetConnection(s); they are named anyway because AWS
+  // revises the policy without notice and these return the password.
+  "glue:GetJob",
+  "glue:GetJobs",
+  "glue:BatchGetJobs",
+  "glue:GetConnection",
+  "glue:GetConnections",
+  "glue:GetDevEndpoint",
+  "glue:GetDevEndpoints",
+  "glue:BatchGetDevEndpoints",
+
+  // SageMaker container `Environment` maps on models and jobs.
+  "sagemaker:DescribeModel",
+  "sagemaker:DescribeTrainingJob",
+  "sagemaker:DescribeProcessingJob",
+  "sagemaker:DescribeTransformJob",
+
+  // Data Pipeline definitions hold activity fields, database passwords included.
+  "datapipeline:GetPipelineDefinition",
+
+  // AppSync: API key values, and HTTP data source authorization config.
+  "appsync:ListApiKeys",
+  "appsync:GetDataSource",
+  "appsync:ListDataSources",
+
+  // Kinesis Data Analytics / Managed Flink environment properties.
+  "kinesisanalytics:DescribeApplication",
+
+  // Lightsail bucket access keys and container service environment.
+  "lightsail:GetBucketAccessKeys",
+  "lightsail:GetContainerServices",
+  "lightsail:GetContainerServiceDeployments",
+
+  // OpsWorks app environment variables and stack custom JSON.
+  "opsworks:DescribeApps",
+  "opsworks:DescribeStacks",
+
+  // Calls that MINT a credential rather than describe one.
+  "cognito-identity:GetCredentialsForIdentity",
+  "cognito-identity:GetOpenIdToken",
+  "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
+  "connect:GetFederationToken",
+  "codeartifact:GetAuthorizationToken",
+];