Class OperatorProvisioningPermissionMatrix

java.lang.Object
com.cloudforgeci.api.core.iam.OperatorProvisioningPermissionMatrix
public final class OperatorProvisioningPermissionMatrix extends Object
Permission matrix for the operator provisioning layer: the AWS actions CloudForge Manager's task role needs, as the calling principal, to create and manage the infrastructure a deploy:create target application's CloudFormation template describes (VPC, EFS, ALB, ECS cluster/service/task definition).

This is a different layer than PermissionMatrix. PermissionMatrix defines what a deployed app's task role can do at runtime (pull its image, read SSM parameters, put CloudWatch metrics). This class defines what Manager's role needs to create and delete that app's infrastructure, because CloudFormation issues those calls under Manager's identity.

Tiered by the same IAMProfile enum as PermissionMatrix: MINIMAL is read-only (inventory and troubleshooting; Describe/List actions accept no Tags parameter to condition on), STANDARD is the full lifecycle for the Fargate + ALB + EFS shape catalog apps deploy, and EXTENDED adds flow logs and custom network ACLs. ManagerOperatorIamSupport.deployStatements(SystemContext) currently uses EXTENDED for Manager's task role because there is no per-user AWS-level distinction yet.

Planned direction: rather than running deploy:create requests directly under Manager's task role, Manager would assume an operator role with a session policy scoped to the IAMProfile tier a request needs, using its existing RBAC catalog (ManagerPolicyCatalog) and sts:AssumeRole support. Users without the deploy:create capability could then never obtain infrastructure-creation permissions. This class is intended to remain the single source of truth for those action lists.

  • Field Details

    • VPC_PERMISSIONS

      public static final Map<IAMProfile, List<String>> VPC_PERMISSIONS
      VpcFactory's Vpc L2 construct: every EC2 networking resource type it can synthesize. VpcFactory always creates public and private-with-egress subnet pairs across two AZs, so NAT/EIP/route-table actions are at STANDARD. EXTENDED_ONLY_VPC_PERMISSIONS holds the EXTENDED-only actions (flow logs and custom network ACLs, which VpcFactory does not enable by default).

    • EXTENDED_ONLY_VPC_PERMISSIONS

      public static final List<String> EXTENDED_ONLY_VPC_PERMISSIONS
      Flow logs and custom network ACLs -- not part of VpcFactory's default topology, only relevant for a compliance-driven or hardened network profile.

    • EFS_PERMISSIONS

      public static final Map<IAMProfile, List<String>> EFS_PERMISSIONS
      EfsFactory's FileSystem/AccessPoint L2 constructs.

    • ALB_PERMISSIONS

      public static final Map<IAMProfile, List<String>> ALB_PERMISSIONS
      AlbFactory's ApplicationLoadBalancer/ ApplicationTargetGroup L2 constructs.

    • ACM_PERMISSIONS

      public static final Map<IAMProfile, List<String>> ACM_PERMISSIONS
      FargateRuntimeConfiguration's public ACM Certificate L2 construct (SSL with a custom domain, DNS-validated against the app's Route 53 hosted zone). CloudFormation's AWS::CertificateManager::Certificate handler calls these actions with the caller's identity. Grouped with the network category (getNetworkPermissions(IAMProfile)) because the certificate backs the ALB's HTTPS listener. The private-CA fallback (acm-pca:*) is a separate category; see ACM_PCA_PERMISSIONS.

    • ROUTE53_PERMISSIONS

      public static final Map<IAMProfile, List<String>> ROUTE53_PERMISSIONS
      DomainFactory's HostedZone L2 construct. MINIMAL covers the ListHostedZonesByName lookup in CloudForgeSynthesizer#seedHostedZoneContext (which runs under this operator role) and the read-only calls HostedZone.fromLookup needs; STANDARD covers the hosted-zone lifecycle for createZone=true and the record sets that point at the app's ALB or CloudFront distribution.

    • ACM_PCA_PERMISSIONS

      public static final Map<IAMProfile, List<String>> ACM_PCA_PERMISSIONS
      FargateRuntimeConfiguration's private-CA fallback (CfnCertificateAuthority/CfnCertificateAuthorityActivation), used when SSL is enabled without a custom domain. Separate from ACM_PERMISSIONS because acm-pca:* is a distinct action prefix.

    • CLOUDFRONT_PERMISSIONS

      public static final Map<IAMProfile, List<String>> CLOUDFRONT_PERMISSIONS
      CmsCdnConfiguration/S3WebsiteTopologyConfiguration's Distribution L2 construct — CDN in front of an app's ALB origin or an S3-hosted static site.

    • S3_APP_BUCKET_PERMISSIONS

      public static final Map<IAMProfile, List<String>> S3_APP_BUCKET_PERMISSIONS
      S3WebsiteTopologyConfiguration's Bucket L2 construct (a static-site origin) — distinct from ManagerOperatorIamSupport's own S3 grants, which are scoped to Manager's own fixed-prefix template/CDK-asset buckets, never an arbitrary bucket a deployed app's own template declares.

    • ECS_PERMISSIONS

      public static final Map<IAMProfile, List<String>> ECS_PERMISSIONS
      FargateFactory's Cluster/ FargateService/FargateTaskDefinition L2 constructs -- registering and running the task definition, not the workload permissions the running task itself needs (that's PermissionMatrix).

    • LOGS_PERMISSIONS

      public static final Map<IAMProfile, List<String>> LOGS_PERMISSIONS
      Creating the target app's AWS::Logs::LogGroup. Separate from PermissionMatrix.CORE_PERMISSIONS, which covers the deployed app's task role writing to that log group at runtime.

    • DATABASE_PERMISSIONS

      public static final Map<IAMProfile, List<String>> DATABASE_PERMISSIONS
      RdsFactory's DatabaseInstance/ ParameterGroup/SubnetGroup L2 constructs, plus the KMS key and Secrets Manager secret every encrypted instance provisions alongside it -- grouped together, not split into three separate maps, since RdsFactory always creates the three together for any app whose DatabaseSpec requests a database (there is no "RDS without its own secret and key" shape in this codebase to scope more narrowly than that). kms:CreateKey's own tagging step fails with "UnauthorizedTaggingOperation" without kms:TagResource granted alongside it (see ManagerOperatorIamSupport's iamRoleCreate for the same CloudFormation error-classification label on a different action -- it denotes any denied create-with-tags call, not a tag-condition mismatch specifically).

    • COMPLIANCE_PERMISSIONS

      public static final Map<IAMProfile, List<String>> COMPLIANCE_PERMISSIONS
      ComplianceFactory/GuardDutyFactory/WafFactory -- deliberately its own dimension, not a fourth IAMProfile tier, since compliance mode is an independent boolean toggle on DeploymentConfig (complianceMode/awsConfigEnabled/ guardDutyEnabled), orthogonal to which IAMProfile tier an app's own workload role runs under. AWS Config and GuardDuty are both account-level singletons, and enabling either for the very first time in an account requires iam:CreateServiceLinkedRole for that service's own service-linked role -- a step with no equivalent in the VPC/EFS/ALB/ECS categories above, easy to miss because it's only needed exactly once per account, not once per deployment.

    • SCALING_PERMISSIONS

      public static final Map<IAMProfile, List<String>> SCALING_PERMISSIONS
      ScalingFactory's Fargate service scaleOnCpuUtilization/EnableScalingProps and Ec2Factory's AutoScalingGroup#scaleOnCpuUtilization -- two distinct AWS services (Application Auto Scaling registers the ECS service as a scalable target; EC2 Auto Scaling owns the ASG directly), kept as one category rather than two small ones.

    • COGNITO_PERMISSIONS

      public static final Map<IAMProfile, List<String>> COGNITO_PERMISSIONS
      CognitoAuthenticationFactory/CognitoSamlFactory's UserPool/ UserPoolClient/UserPoolDomain L2 constructs (application-oidc's own identity provider) -- the AwsCustomResource calls both classes also make (SAML IdP config, client-secret retrieval) carry their own dedicated, narrowly-scoped IAM policy per AWS CDK's own custom-resource convention, so those don't need anything added here.

    • MONITORING_PERMISSIONS

      public static final Map<IAMProfile, List<String>> MONITORING_PERMISSIONS
      AlarmFactory/SecurityMonitoringFactory's Alarm/ Metric/Topic constructs -- CloudWatch alarms and their SNS notification target, one category since neither is useful without the other here (every alarm this platform creates wires an SnsAction). Distinct from LOGS_PERMISSIONS: CloudWatch Logs and CloudWatch metrics/alarms are different action prefixes (logs:* vs cloudwatch:*) despite sharing a console.

    • BACKUP_PERMISSIONS

      public static final Map<IAMProfile, List<String>> BACKUP_PERMISSIONS
      BackupFactory's BackupVault/ BackupPlan/BackupSelection L2 constructs -- BackupSelection also creates its own IAM role, explicitly named (see BackupFactory#createSelectionRole) so ManagerOperatorIamSupport#IAM_ROLE_MANAGE_RESOURCES's -CfcBackupSelection pattern can match it; that role's own create/manage permissions live there, not here.

  • Method Details