Class OperatorProvisioningPermissionMatrix

java.lang.Object
com.cloudforgeci.api.core.iam.OperatorProvisioningPermissionMatrix
public final class OperatorProvisioningPermissionMatrix extends Object
Permission matrix for the operator provisioning layer — the AWS actions CloudForge Manager's own task role needs, acting as the calling principal, to actually create/manage the infrastructure a deploy:create target application's synthesized CloudFormation template describes (VPC, EFS, ALB, ECS cluster/service/task definition).

This is a different layer than PermissionMatrix. PermissionMatrix defines what a deployed app's own task role can do once it's running (pull its image, read SSM params, put CloudWatch metrics). This class defines what Manager's own role needs to bring that app's infrastructure into existence and tear it back down in the first place — CloudFormation issues every one of these calls under Manager's identity, not the deployed app's. A stack's own workload permissions being perfectly correct (which PermissionMatrix already ensures) says nothing about whether Manager was ever allowed to create that stack's VPC/EFS/ALB/ECS resources at all.

Tiered by the same IAMProfile enum PermissionMatrix uses, not a parallel concept — MINIMAL is read-only (inventory/troubleshooting, no condition since Describe- and List-family actions don't accept a Tags parameter to condition on), STANDARD is full lifecycle for the single Fargate+ALB+EFS shape every catalog app in this platform actually deploys today, and EXTENDED adds the NAT/EIP/flow-log surface a private-with-egress network topology needs. ManagerOperatorIamSupport.deployStatements(SystemContext) currently bakes in EXTENDED unconditionally for Manager's own task role, since there is no per-user AWS-level distinction yet — see the design note below for where that's headed.

Future direction, not built yet: Manager already has a real, working per-user RBAC policy catalog (ManagerPolicyCatalog, manager_user_policy) with a deploy:create capability gating this exact feature today, and a real sts:AssumeRole pathway (AssumeRoleOperations/StsAssumeRoleService) already built for cross-account connections. The intended seam: instead of a deploy:create request running directly under Manager's task role credentials, Manager assumes its own (or a dedicated operator) role with a session policy scoped to the IAMProfile tier this matrix says that request needs — so a Manager user without the deploy:create RBAC capability can never reach AWS-level infrastructure-creation capability even if something upstream misbehaves, because the session policy would never carry those actions to begin with. This class is written so that seam only ever needs one source of truth on the AWS side — never two independently-maintained action lists drifting apart.

  • Field Details

    • VPC_PERMISSIONS

      public static final Map<IAMProfile, List<String>> VPC_PERMISSIONS
      VpcFactory's Vpc L2 construct — every underlying EC2 networking resource type it can synthesize depending on subnet configuration (VpcFactory always creates public+private-with-egress subnet pairs across 2 AZs for every app in this catalog, hence NAT/EIP/route-table actions live at STANDARD, not EXTENDED, despite the class javadoc's general EXTENDED-adds-NAT framing above -- see EXTENDED_ONLY_VPC_PERMISSIONS for what genuinely is EXTENDED-only: flow logs and custom network ACLs, neither of which VpcFactory enables by default).

    • EXTENDED_ONLY_VPC_PERMISSIONS

      public static final List<String> EXTENDED_ONLY_VPC_PERMISSIONS
      Flow logs and custom network ACLs -- not part of VpcFactory's default topology, only relevant for a compliance-driven or hardened network profile.

    • EFS_PERMISSIONS

      public static final Map<IAMProfile, List<String>> EFS_PERMISSIONS
      EfsFactory's FileSystem/AccessPoint L2 constructs.

    • ALB_PERMISSIONS

      public static final Map<IAMProfile, List<String>> ALB_PERMISSIONS
      AlbFactory's ApplicationLoadBalancer/ ApplicationTargetGroup L2 constructs.

    • ECS_PERMISSIONS

      public static final Map<IAMProfile, List<String>> ECS_PERMISSIONS
      FargateFactory's Cluster/ FargateService/FargateTaskDefinition L2 constructs -- registering and running the task definition, not the workload permissions the running task itself needs (that's PermissionMatrix).

    • LOGS_PERMISSIONS

      public static final Map<IAMProfile, List<String>> LOGS_PERMISSIONS
      Manager creating the target app's own AWS::Logs::LogGroup as part of its infrastructure -- separate from PermissionMatrix.CORE_PERMISSIONS, which is what the deployed app's own task role needs to write into that log group at runtime.

    • DATABASE_PERMISSIONS

      public static final Map<IAMProfile, List<String>> DATABASE_PERMISSIONS
      RdsFactory's DatabaseInstance/ ParameterGroup/SubnetGroup L2 constructs, plus the KMS key and Secrets Manager secret every encrypted instance provisions alongside it -- grouped together, not split into three separate maps, since RdsFactory always creates the three together for any app whose DatabaseSpec requests a database (there is no "RDS without its own secret and key" shape in this codebase to scope more narrowly than that). kms:CreateKey's own tagging step fails with "UnauthorizedTaggingOperation" without kms:TagResource granted alongside it (see ManagerOperatorIamSupport's iamRoleCreate for the same CloudFormation error-classification label on a different action -- it denotes any denied create-with-tags call, not a tag-condition mismatch specifically).

    • COMPLIANCE_PERMISSIONS

      public static final Map<IAMProfile, List<String>> COMPLIANCE_PERMISSIONS
      ComplianceFactory/GuardDutyFactory/WafFactory -- deliberately its own dimension, not a fourth IAMProfile tier, since compliance mode is an independent boolean toggle on DeploymentConfig (complianceMode/awsConfigEnabled/ guardDutyEnabled), orthogonal to which IAMProfile tier an app's own workload role runs under. AWS Config and GuardDuty are both account-level singletons, and enabling either for the very first time in an account requires iam:CreateServiceLinkedRole for that service's own service-linked role -- a step with no equivalent in the VPC/EFS/ALB/ECS categories above, easy to miss because it's only needed exactly once per account, not once per deployment.

  • Method Details

    • getRequiredPermissions

      public static List<String> getRequiredPermissions(IAMProfile tier, boolean includeCompliance)
      All actions needed at or below the given tier, across every provisioning category, for a single flat action list -- mirrors PermissionMatrix.getRequiredPermissions(TopologyType, RuntimeType, IAMProfile)' additive-tier shape (STANDARD includes MINIMAL, EXTENDED includes STANDARD). includeCompliance pulls in COMPLIANCE_PERMISSIONS at the same tier, kept as a separate parameter rather than a fourth tier value for the reason documented on that map.

    • getNetworkPermissions

      public static List<String> getNetworkPermissions(IAMProfile tier)
      getRequiredPermissions(IAMProfile, boolean)'s full action list, split roughly in half by measured JSON byte size rather than by category count -- VPC_PERMISSIONS/ALB_PERMISSIONS/ EFS_PERMISSIONS ("network") on one side, ECS_PERMISSIONS/LOGS_PERMISSIONS/DATABASE_PERMISSIONS/COMPLIANCE_PERMISSIONS ("compute/data") on the other. Exists because of a hard AWS ceiling: an IAM role's combined inline-policy size across every inline policy document it carries is capped at 10,240 bytes total, not a separate budget per document -- this class's flat list (212 actions, ~6.3KB on its own) exceeds that cap alongside the role's other inline policies. ManagerOperatorIamSupport attaches each half as its own customer-managed policy instead of inline specifically to sidestep that combined-inline ceiling (a managed policy's size budget is independent of it), so the split point here only needs to keep each half comfortably under a managed policy's own (smaller, ~6,144-byte default) size limit, measured against the real synthesized byte counts per AWS service prefix.

    • getComputeAndDataPermissions

      public static List<String> getComputeAndDataPermissions(IAMProfile tier, boolean includeCompliance)
      See getNetworkPermissions(IAMProfile) -- the other half of the same split.