Drop the machine-type memory reads from the WIF roles [murmur:murmuration/record-actual-vm-shape-costs]

[maerlyn5]

compute.machineTypes.get and ec2:DescribeInstanceTypes were granted so murmuration could read a machine type's RAM at VM creation, sizing GCE's suspend snapshot and AWS's hibernation swap volume. It no longer asks: the chosen machine type fixes its RAM and CatalogMachineType.memory_gb already records it, so the cloud read was a second answer to a question with one — bought at the price of a permission on every customer's role.

Both are now unused, and this removes them from modules/gcp-wif and modules/aws-wif.

The boot-disk read stays and needs nothing new: disk_size_gb may be left unset to mean "take the boot image's own size", so only the created disk knows the GiB a customer is charged for. That runs on compute.instances.get and ec2:DescribeImages, which these roles already hold.

Pairs with prassoai/murmuration#6231, which removes the calls. Merge order does not matter — removing a permission nothing requests, and removing a request for a permission, are independently safe.

Supersedes #8, which was closed. That branch carried the pre-squash version of #7's grant commit followed by this removal, so a reviewer diffing it against its own base saw a grant added and taken away and read the whole PR as a no-op. Against main it was not: main carries #7's grants today. This branch is cut from main and contains only the removal, so the diff says what it does.

Created via Murmur

Note

Drop machine-type memory read permissions from AWS and GCP WIF roles

• Removes the ec2:DescribeInstanceTypes action from the vm_creator inline policy in modules/aws-wif/main.tf
• Removes the compute.machineTypes.get permission from the vm_lifecycle custom role in modules/gcp-wif/main.tf
• Behavioral Change: Principals assuming aws_iam_role.vm_creator or granted the murmurVmCreator custom role can no longer read machine-type memory information

^{Macroscope summarized 3ba8583.}

[macroscopeapp-nonprod]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes customer-facing AWS and GCP WIF IAM policies by revoking machine-type metadata permissions from VM roles. Although the diff is small and focused, authorization changes are security-sensitive and require human review.

^{You can add or adjust custom eligibility rules. Learn more.}