@ripla/godd-mcp 1.0.4-canary.9 → 1.0.4

package/templates/prompts/sync.hbs

@@ -1,63 +0,0 @@
-{{> ssot-header }}
-
-{{> godd-core }}
-
-{{> ssot-rules }}
-
-{{> project-context }}
-
-{{> cogito-grammar }}
-{{> cogito-root-core }}
-{{> cogito-particle }}
-{{> cogito-godd }}
-{{> cogito-root-dev }}
-
-## Purpose
-Sync the current working branch with the latest changes from the default branch (main). Resolve merge conflicts if they occur — the Agent handles everything up to and including conflict resolution.
-
-## Prerequisites
-- Default branch: `main` (`origin/main`)
-- Sync method: **merge** (preserves history so conflict resolution context is visible during review)
-
-## Agent Steps (MUST)
-
-### Step 1: Pre-check
-1. Run `git status` to check for uncommitted changes
-   - **If uncommitted changes exist**: Run `git stash --include-untracked` to stash them (restore in Step 5)
-   - **If clean**: Proceed
-2. Record the current branch name via `git branch --show-current`
-
-### Step 2: Fetch Remote Latest
-1. Run `git fetch origin main`
-2. Check diff with `git log --oneline HEAD..origin/main`
-   - **If no diff**: Report "Already up to date" and exit (restore stash if applicable)
-
-### Step 3: Merge
-1. Run `git merge origin/main`
-2. Check result:
-   - **Success (Fast-forward / Auto-merge)**: Go to Step 5
-   - **Conflict**: Go to Step 4
-
-### Step 4: Conflict Resolution (only if conflicts occur)
-1. List conflicted files with `git diff --name-only --diff-filter=U`
-2. Read each conflicted file and identify conflict markers (`<<<<<<<` / `=======` / `>>>>>>>`)
-3. **Resolution policy (priority order)**:
-   1. **Keep the SSOT-compliant side**: If one side adheres to SSOT (`docs/003_requirements/spec/`, `.github/agents/user-clone.agent.md`, etc.) and the other diverges, **adopt the compliant side**
-   2. **Both SSOT-compliant and integrable**: If both sides comply with SSOT and can be functionally integrated, **integrate both**
-   3. **Both compliant but integration difficult / uncertain**: If safe integration is not possible, **ask the user** (never guess)
-4. After resolving all conflicts:
-   - `git add <resolved files>` to stage
-   - `git commit` to complete the merge commit (use Git's default message)
-5. Report resolution details (which files, what was chosen)
-
-### Step 5: Restore Stash (only if stashed)
-1. Run `git stash pop` to restore stashed changes
-2. If stash pop causes conflicts:
-   - Resolve using the same policy and report
-
-## Output
-- **Sync result**: Success / Conflicts resolved / Already up to date
-- **Commits synced**: Number of commits from `origin/main`
-- **Conflict resolution details** (if applicable): File names and resolution policy applied
-- **Stash restore result** (if applicable): Success / Conflicts
-- **Current branch state**: `git log --oneline -5`

package/templates/prompts/test-plan.hbs

@@ -1,56 +0,0 @@
-{{> ssot-header }}
-
-{{> godd-core }}
-
-{{> ssot-rules }}
-
-{{> project-context }}
-
-{{> cogito-grammar }}
-{{> cogito-root-core }}
-{{> cogito-particle }}
-{{> cogito-godd }}
-{{> cogito-root-dev }}
-
-## Purpose
-Create a test plan that keeps implementation and verification in sync.
-Follow ATDD principles: define what "done" looks like through tests before implementation.
-
-## Input
-- Change details (spec / implementation diff)
-- Likely failure points (boundary values / error cases)
-
-## Test Plan Structure
-
-### 1. Acceptance Criteria
-Define in **Given-When-Then** format:
-```
-Given [precondition: initial system state]
-When  [action/event: user or system behavior]
-Then  [expected result: verifiable outcome]
-```
-
-### 2. Test Layers
-Indicate which layers are needed with rationale:
-
-| Layer | When to Use | Priority |
-|-------|------------|----------|
-| **Unit** | Domain logic, business rules, pure functions | Highest — always write these |
-| **Integration** | API boundaries, DB queries, external service calls | Write for critical boundaries |
-| **E2E** | Login flow, main CRUD operations, critical user journeys | Write for key user flows only |
-
-### 3. Test Cases
-For each acceptance criterion:
-- **Happy path**: Normal expected behavior
-- **Error cases**: Invalid input, unauthorized access, resource not found
-- **Boundary values**: Empty, null, max length, zero, negative
-- **Concurrency**: Race conditions, parallel access (if applicable)
-
-## Output
-Markdown filling in each section of the test plan:
-- **Scope**: What is being tested and what is excluded
-- **Acceptance criteria**: Given-When-Then for each behavior
-- **Test cases**: Organized by layer (unit / integration / e2e)
-- **Test data**: Required fixtures and setup
-- **Environment**: Required infrastructure (DB, services, etc.)
-- **Execution commands**: Exact commands to run each test suite

package/templates/scripts/aws/terraform-backend-setup.sh.hbs

@@ -1,149 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Generated by: godd notes infra (AWS)
-# Terraform state 用 S3 バケット + KMS キー + DynamoDB テーブルを作成する。
-# CI/CD・Terraform 構築前に 1 回だけ手動実行する。
-
-BUCKET="${BUCKET:-godd-notes-tfstate-{{accountId}}{{!--brk--}}}"
-KMS_ALIAS="${KMS_ALIAS:-alias/godd-tfstate}"
-REGION="${REGION:-{{region}}{{!--brk--}}}"
-DYNAMODB_TABLE="${DYNAMODB_TABLE:-godd-notes-tfstate-lock}"
-
-usage() {
-  cat <<EOF
-Usage: $0 [--bucket BUCKET] [--kms-alias KMS_ALIAS] [--region REGION] [--dynamodb-table TABLE]
-
-Terraform state 用 S3 バケット + KMS キー + DynamoDB テーブルを作成する。
-各アカウントで CI/CD・Terraform 構築前に 1 回だけ手動実行する。
-
-デフォルト値はウィザード入力値から自動設定済み。
-引数なしでそのまま実行可能。
-
-Options:
-  --bucket          S3 バケット名         [default: ${BUCKET}]
-  --kms-alias       KMS エイリアス        [default: ${KMS_ALIAS}]
-  --region          AWS リージョン        [default: ${REGION}]
-  --dynamodb-table  DynamoDB テーブル名   [default: ${DYNAMODB_TABLE}]
-  --help, -h        このヘルプを表示
-
-Example:
-  # デフォルト値でそのまま実行
-  $0
-
-  # リージョンだけ変更
-  $0 --region us-west-2
-EOF
-  exit 0
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --bucket)         BUCKET="$2"; shift 2 ;;
-    --kms-alias)      KMS_ALIAS="$2"; shift 2 ;;
-    --region)         REGION="$2"; shift 2 ;;
-    --dynamodb-table) DYNAMODB_TABLE="$2"; shift 2 ;;
-    --help|-h)        usage ;;
-    *)                echo "Unknown option: $1" >&2; usage ;;
-  esac
-done
-
-echo "==> Terraform backend setup"
-echo "    Bucket:         ${BUCKET}"
-echo "    KMS Alias:      ${KMS_ALIAS}"
-echo "    Region:         ${REGION}"
-echo "    DynamoDB Table: ${DYNAMODB_TABLE}"
-echo ""
-
-# --- S3 bucket ---
-
-echo "==> Creating S3 bucket: ${BUCKET} (region: ${REGION})"
-if aws s3api head-bucket --bucket "$BUCKET" 2>/dev/null; then
-  echo "    Bucket already exists, skipping creation."
-else
-  if [[ "$REGION" == "us-east-1" ]]; then
-    aws s3api create-bucket --bucket "$BUCKET" --region "$REGION"
-  else
-    aws s3api create-bucket \
-      --bucket "$BUCKET" \
-      --region "$REGION" \
-      --create-bucket-configuration LocationConstraint="$REGION"
-  fi
-fi
-
-echo "==> Enabling versioning on ${BUCKET}"
-aws s3api put-bucket-versioning \
-  --bucket "$BUCKET" \
-  --versioning-configuration Status=Enabled
-
-echo "==> Blocking public access on ${BUCKET}"
-aws s3api put-public-access-block \
-  --bucket "$BUCKET" \
-  --public-access-block-configuration \
-    BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
-
-# --- KMS key ---
-
-KMS_ALIAS_NAME="${KMS_ALIAS#alias/}"
-
-echo "==> Checking KMS alias: ${KMS_ALIAS}"
-KMS_KEY_ID=$(aws kms list-aliases --region "$REGION" \
-  --query "Aliases[?AliasName=='alias/${KMS_ALIAS_NAME}'].TargetKeyId | [0]" \
-  --output text 2>/dev/null || true)
-
-if [[ "$KMS_KEY_ID" == "None" || -z "$KMS_KEY_ID" ]]; then
-  echo "==> Creating KMS key"
-  KMS_KEY_ID=$(aws kms create-key \
-    --region "$REGION" \
-    --description "Terraform state encryption for ${BUCKET}" \
-    --tags TagKey=Project,TagValue=godd-notes TagKey=ManagedBy,TagValue=script \
-    --query KeyMetadata.KeyId \
-    --output text)
-
-  echo "==> Creating KMS alias: ${KMS_ALIAS}"
-  aws kms create-alias \
-    --region "$REGION" \
-    --alias-name "alias/${KMS_ALIAS_NAME}" \
-    --target-key-id "$KMS_KEY_ID"
-else
-  echo "    KMS alias already exists (KeyId: ${KMS_KEY_ID}), skipping."
-fi
-
-echo "==> Setting default encryption on ${BUCKET} with KMS key"
-aws s3api put-bucket-encryption \
-  --bucket "$BUCKET" \
-  --server-side-encryption-configuration "{
-    \"Rules\": [{
-      \"ApplyServerSideEncryptionByDefault\": {
-        \"SSEAlgorithm\": \"aws:kms\",
-        \"KMSMasterKeyID\": \"${KMS_KEY_ID}\"
-      },
-      \"BucketKeyEnabled\": true
-    }]
-  }"
-
-# --- DynamoDB table (state locking) ---
-
-echo "==> Checking DynamoDB table: ${DYNAMODB_TABLE}"
-if aws dynamodb describe-table --table-name "$DYNAMODB_TABLE" --region "$REGION" >/dev/null 2>&1; then
-  echo "    DynamoDB table already exists, skipping creation."
-else
-  echo "==> Creating DynamoDB table: ${DYNAMODB_TABLE}"
-  aws dynamodb create-table \
-    --table-name "$DYNAMODB_TABLE" \
-    --attribute-definitions AttributeName=LockID,AttributeType=S \
-    --key-schema AttributeName=LockID,KeyType=HASH \
-    --billing-mode PAY_PER_REQUEST \
-    --region "$REGION" \
-    --tags Key=Project,Value=godd-notes Key=ManagedBy,Value=script >/dev/null
-  echo "    Waiting for table to become active..."
-  aws dynamodb wait table-exists --table-name "$DYNAMODB_TABLE" --region "$REGION"
-fi
-
-echo ""
-echo "=== Setup complete ==="
-echo "  Bucket:         ${BUCKET}"
-echo "  KMS Alias:      ${KMS_ALIAS}"
-echo "  KMS KeyId:      ${KMS_KEY_ID}"
-echo "  DynamoDB Table: ${DYNAMODB_TABLE}"
-echo "  Region:         ${REGION}"

package/templates/terraform/aws/alb.tf.hbs

@@ -1,58 +0,0 @@
-resource "aws_lb" "api" {
-  name               = "${local.project}-alb"
-  internal           = false
-  load_balancer_type = "application"
-  security_groups    = [aws_security_group.alb.id]
-  subnets            = [aws_subnet.public_1a.id, aws_subnet.public_1c.id]
-  tags               = local.tags
-}
-
-resource "aws_lb_target_group" "api" {
-  name        = "${local.project}-tg"
-  port        = local.container_port
-  protocol    = "HTTP"
-  vpc_id      = aws_vpc.main.id
-  target_type = "ip"
-  tags        = local.tags
-
-  health_check {
-    path                = "/api/health"
-    interval            = 30
-    timeout             = 5
-    healthy_threshold   = 3
-    unhealthy_threshold = 3
-    matcher             = "200"
-  }
-}
-
-resource "aws_lb_listener" "http" {
-  load_balancer_arn = aws_lb.api.arn
-  port              = 80
-  protocol          = "HTTP"
-
-  default_action {
-    type = "fixed-response"
-    fixed_response {
-      content_type = "text/plain"
-      message_body = "Forbidden"
-      status_code  = "403"
-    }
-  }
-}
-
-resource "aws_lb_listener_rule" "verify_origin" {
-  listener_arn = aws_lb_listener.http.arn
-  priority     = 1
-
-  condition {
-    http_header {
-      http_header_name = "X-Origin-Verify"
-      values           = [random_password.origin_verify.result]
-    }
-  }
-
-  action {
-    type             = "forward"
-    target_group_arn = aws_lb_target_group.api.arn
-  }
-}

package/templates/terraform/aws/backend.tf.hbs

@@ -1,10 +0,0 @@
-terraform {
-  backend "s3" {
-    bucket         = "godd-notes-tfstate-{{accountId}}"
-    key            = "{{env}}/terraform.tfstate"
-    region         = "{{region}}"
-    encrypt        = true
-    kms_key_id     = "alias/godd-tfstate"
-    dynamodb_table = "godd-notes-tfstate-lock"
-  }
-}

package/templates/terraform/aws/cloudfront.tf.hbs

@@ -1,96 +0,0 @@
-resource "aws_cloudfront_origin_access_control" "notes_app" {
-  name                              = "${local.project}-oac"
-  origin_access_control_origin_type = "s3"
-  signing_behavior                  = "always"
-  signing_protocol                  = "sigv4"
-}
-
-resource "random_password" "origin_verify" {
-  length  = 64
-  special = false
-}
-
-resource "aws_cloudfront_distribution" "notes" {
-  enabled             = true
-  default_root_object = "index.html"
-  price_class         = "PriceClass_200"
-  tags                = local.tags
-
-  # S3 Origin (SPA)
-  origin {
-    domain_name              = aws_s3_bucket.notes_app.bucket_regional_domain_name
-    origin_id                = "s3-origin"
-    origin_access_control_id = aws_cloudfront_origin_access_control.notes_app.id
-  }
-
-  # ALB Origin (API)
-  origin {
-    domain_name = aws_lb.api.dns_name
-    origin_id   = "api-origin"
-
-    custom_origin_config {
-      http_port              = 80
-      https_port             = 443
-      origin_protocol_policy = "http-only"
-      origin_ssl_protocols   = ["TLSv1.2"]
-    }
-
-    custom_header {
-      name  = "X-Origin-Verify"
-      value = random_password.origin_verify.result
-    }
-  }
-
-  # Default behavior → S3
-  default_cache_behavior {
-    allowed_methods        = ["GET", "HEAD"]
-    cached_methods         = ["GET", "HEAD"]
-    target_origin_id       = "s3-origin"
-    viewer_protocol_policy = "redirect-to-https"
-
-    forwarded_values {
-      query_string = false
-      cookies { forward = "none" }
-    }
-  }
-
-  # /api/* → ALB
-  ordered_cache_behavior {
-    path_pattern           = "/api/*"
-    allowed_methods        = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
-    cached_methods         = ["GET", "HEAD"]
-    target_origin_id       = "api-origin"
-    viewer_protocol_policy = "redirect-to-https"
-
-    forwarded_values {
-      query_string = true
-      headers      = ["Authorization", "Origin", "Accept"]
-      cookies { forward = "all" }
-    }
-
-    min_ttl     = 0
-    default_ttl = 0
-    max_ttl     = 0
-  }
-
-  # SPA fallback
-  custom_error_response {
-    error_code         = 403
-    response_code      = 200
-    response_page_path = "/index.html"
-  }
-
-  custom_error_response {
-    error_code         = 404
-    response_code      = 200
-    response_page_path = "/index.html"
-  }
-
-  restrictions {
-    geo_restriction { restriction_type = "none" }
-  }
-
-  viewer_certificate {
-    cloudfront_default_certificate = true
-  }
-}

package/templates/terraform/aws/ecr.tf.hbs

@@ -1,30 +0,0 @@
-resource "aws_ecr_repository" "notes_api" {
-  name                 = "godd-notes-api"
-  image_tag_mutability = "MUTABLE"
-  force_delete         = local.env == "dev"
-  tags                 = local.tags
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-}
-
-resource "aws_ecr_lifecycle_policy" "notes_api" {
-  repository = aws_ecr_repository.notes_api.name
-
-  policy = jsonencode({
-    rules = [
-      {
-        rulePriority = 1
-        description  = "Delete untagged images after 1 day"
-        selection = {
-          tagStatus   = "untagged"
-          countType   = "sinceImagePushed"
-          countUnit   = "days"
-          countNumber = 1
-        }
-        action = { type = "expire" }
-      }
-    ]
-  })
-}

package/templates/terraform/aws/ecs.tf.hbs

@@ -1,142 +0,0 @@
-resource "aws_ecs_cluster" "main" {
-  name = local.project
-  tags = local.tags
-}
-
-resource "aws_cloudwatch_log_group" "ecs" {
-  name              = "/ecs/godd-notes-api"
-  retention_in_days = 30
-  tags              = local.tags
-}
-
-resource "aws_iam_role" "ecs_task_execution" {
-  name = "${local.project}-ecs-task-execution"
-  tags = local.tags
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "ecs_task_execution" {
-  role       = aws_iam_role.ecs_task_execution.name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
-}
-
-resource "aws_iam_role_policy" "ecs_secrets" {
-  name = "${local.project}-ecs-secrets"
-  role = aws_iam_role.ecs_task_execution.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["secretsmanager:GetSecretValue"]
-      Resource = "arn:aws:secretsmanager:${local.region}:${local.account_id}:secret:godd-notes/${local.env}/*"
-    }]
-  })
-}
-
-resource "aws_iam_role" "ecs_task" {
-  name = "${local.project}-ecs-task"
-  tags = local.tags
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_ecs_task_definition" "api" {
-  family                   = "godd-notes-api"
-  requires_compatibilities = ["FARGATE"]
-  network_mode             = "awsvpc"
-  cpu                      = local.ecs_cpu
-  memory                   = local.ecs_memory
-  execution_role_arn       = aws_iam_role.ecs_task_execution.arn
-  task_role_arn            = aws_iam_role.ecs_task.arn
-  tags                     = local.tags
-
-  runtime_platform {
-    operating_system_family = "LINUX"
-    cpu_architecture        = "ARM64"
-  }
-
-  container_definitions = jsonencode([{
-    name      = "notes-api"
-    image     = "${aws_ecr_repository.notes_api.repository_url}:latest"
-    essential = true
-    command   = ["sh", "-c", "alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port ${local.container_port}"]
-
-    portMappings = [{
-      containerPort = local.container_port
-      protocol      = "tcp"
-    }]
-
-    environment = [
-      { name = "DB_PORT", value = "5432" },
-      { name = "DB_NAME", value = local.rds_db_name },
-      { name = "DATABASE_SSL", value = "true" },
-      { name = "API_HOST", value = "0.0.0.0" },
-      { name = "API_PORT", value = tostring(local.container_port) },
-      { name = "ALLOWED_ORIGINS", value = "https://${aws_cloudfront_distribution.notes.domain_name}" },
-      { name = "GITHUB_OWNER", value = local.github_owner },
-      { name = "GITHUB_REPO", value = local.github_repo },
-    ]
-
-    secrets = [
-      { name = "DB_HOST", valueFrom = "${aws_secretsmanager_secret.rds_credentials.arn}:host::" },
-      { name = "DB_USER", valueFrom = "${aws_secretsmanager_secret.rds_credentials.arn}:username::" },
-      { name = "DB_PASSWORD", valueFrom = "${aws_secretsmanager_secret.rds_credentials.arn}:password::" },
-      { name = "JWT_SECRET", valueFrom = aws_secretsmanager_secret.jwt_secret.arn },
-      { name = "GITHUB_TOKEN", valueFrom = aws_secretsmanager_secret.github_token.arn },
-      { name = "GITHUB_APP_ID", valueFrom = aws_secretsmanager_secret.github_app_id.arn },
-      { name = "GITHUB_APP_PRIVATE_KEY", valueFrom = aws_secretsmanager_secret.github_app_private_key.arn },
-      { name = "GITHUB_APP_INSTALLATION_ID", valueFrom = aws_secretsmanager_secret.github_app_installation_id.arn },
-      { name = "NOTES_ADMIN_USERNAME", valueFrom = "${aws_secretsmanager_secret.admin_credentials.arn}:username::" },
-      { name = "NOTES_ADMIN_PASSWORD", valueFrom = "${aws_secretsmanager_secret.admin_credentials.arn}:password::" },
-    ]
-
-    logConfiguration = {
-      logDriver = "awslogs"
-      options = {
-        "awslogs-group"         = aws_cloudwatch_log_group.ecs.name
-        "awslogs-region"        = local.region
-        "awslogs-stream-prefix" = "ecs"
-      }
-    }
-  }])
-}
-
-resource "aws_ecs_service" "api" {
-  name             = "notes-api"
-  cluster          = aws_ecs_cluster.main.id
-  task_definition  = aws_ecs_task_definition.api.arn
-  desired_count    = 1
-  launch_type      = "FARGATE"
-  platform_version = "1.4.0"
-  tags             = local.tags
-
-  enable_execute_command = true
-
-  network_configuration {
-    subnets          = [aws_subnet.public_1a.id]
-    security_groups  = [aws_security_group.ecs.id]
-    assign_public_ip = true
-  }
-
-  load_balancer {
-    target_group_arn = aws_lb_target_group.api.arn
-    container_name   = "notes-api"
-    container_port   = local.container_port
-  }
-}

package/templates/terraform/aws/iam.tf.hbs

@@ -1,88 +0,0 @@
-data "aws_iam_openid_connect_provider" "github" {
-  url = "https://token.actions.githubusercontent.com"
-}
-
-resource "aws_iam_role" "github_actions" {
-  name = "github-actions-${local.env}"
-  tags = local.tags
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Principal = {
-        Federated = data.aws_iam_openid_connect_provider.github.arn
-      }
-      Action = "sts:AssumeRoleWithWebIdentity"
-      Condition = {
-        StringLike = {
-          "token.actions.githubusercontent.com:sub" = "repo:${local.github_owner}/${local.github_repo}:*"
-        }
-        StringEquals = {
-          "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com"
-        }
-      }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "github_actions" {
-  name = "${local.project}-github-actions"
-  role = aws_iam_role.github_actions.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "ECR"
-        Effect = "Allow"
-        Action = [
-          "ecr:GetAuthorizationToken",
-          "ecr:BatchCheckLayerAvailability",
-          "ecr:GetDownloadUrlForLayer",
-          "ecr:BatchGetImage",
-          "ecr:PutImage",
-          "ecr:InitiateLayerUpload",
-          "ecr:UploadLayerPart",
-          "ecr:CompleteLayerUpload",
-        ]
-        Resource = "*"
-      },
-      {
-        Sid    = "ECS"
-        Effect = "Allow"
-        Action = [
-          "ecs:UpdateService",
-          "ecs:DescribeServices",
-          "ecs:DescribeTaskDefinition",
-          "ecs:RegisterTaskDefinition",
-          "iam:PassRole",
-        ]
-        Resource = "*"
-      },
-      {
-        Sid    = "S3"
-        Effect = "Allow"
-        Action = [
-          "s3:PutObject",
-          "s3:GetObject",
-          "s3:DeleteObject",
-          "s3:ListBucket",
-        ]
-        Resource = [
-          "arn:aws:s3:::${local.project}-${local.account_id}",
-          "arn:aws:s3:::${local.project}-${local.account_id}/*",
-        ]
-      },
-      {
-        Sid    = "CloudFront"
-        Effect = "Allow"
-        Action = [
-          "cloudfront:CreateInvalidation",
-          "cloudfront:GetDistribution",
-        ]
-        Resource = "*"
-      },
-    ]
-  })
-}