fix(aws): constrain eks-ci KMS grant creation - #2704
Open
devantler wants to merge 2 commits into
Open
Conversation
Contributor
Author
|
Contributor
Author
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 210e43a. Configure here.
Contributor
Author
Readiness record — promoting this after 18 days as a draftTaken over under the maintainer's direction of 2026-08-08 that every PR in the portfolio is mine to Programmatically tested — pentad clear at Reviewed — Cursor Bugbot check-run at this exact head, Tried and evaluated as a user — read the live cluster rather than reasoning from the diff, and the
The change itself is the standard AWS shape for this: Security floor gained: a bounded Queueing rather than merging directly: |
devantler
marked this pull request as ready for review
August 8, 2026 15:35
devantler
enabled auto-merge
August 8, 2026 15:35
Contributor
Author
Why this promoted PR is not merging — it is blocked, not staleI picked this up as rung-1 work: non-draft, trusted author, checks reporting green, no unresolved
A PR merged an hour ago carries all twenty-seven; this one carries sixteen. The branch was opened The remedy is to update the branch onto current This is not a review finding and nothing here is wrong with the change itself. Flagging it because |
Contributor
Author
Why this sat two days looking mergeableAuto-merge has been armed since 2026-08-08T15:35:40Z, every check reads green, The cause is not a failing check — it is missing ones. Comparing the check-run names present at
The twelve absent from this head are I have refreshed the branch so those workflows run against a current head. The trap worth namingThis state is visually identical to a stale Note the head has moved, so the Bugbot green at |
Contributor
✅
|
Contributor
Author
Why this is red, and the merge-order gate it is waiting onThe failure is not in the negative controls that appear to fail. Every subtest in Root cause. This PR edits The content change is a narrowing, and worth re-approving. Three pins move together, not one. Re-approval needs Merge-order gate — this is why it is parked rather than fixed now. #3053 is already in the merge Next step, in order: let #3053 land → rebase this branch onto Check-name sets were also compared against a CLEAN sibling PR and are now identical (32/32), so the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
eks-ciGitHub OIDC principal could create/pass bounded roles that effectively enabled account-widekms:CreateGrantuse and thereby delegate KMS key access beyond the intended smoke-cluster scope.Description
kms:CreateGrantentry from theSmokeComputePlaneCapallowlist ink8s/providers/hetzner/apps/aws/policy-eks-ci-smoke-boundary.yamlso the broad compute-plane statement no longer permits unconditioned KMS grant creation.KmsGrantsForAwsResourcesOnlystatement that permitskms:CreateGrantonly whenkms:GrantIsForAWSResourceistrue, preserving service-managed smoke-resource grant flows while blocking arbitrary delegated grants.Testing
python3 scripts/validate-embedded-json.pyand it succeeded for the embedded JSON IAM policy blobs.python3 scripts/validate-naming.pyand it succeeded to confirm naming conventions were satisfied.git diff --checkand the diff reported no whitespace/format issues.kubectl kustomize k8s/clusters/local/andkubectl kustomize k8s/clusters/prod/but they could not be executed in this environment becausekubectlis not installed, so full kustomize render could not be validated here.Codex Task