Repository navigation
feat: plan identity center access for human and agent - #15
Open
agent-walkllc wants to merge 16 commits into
Open
agent-walkllc wants to merge 16 commits into
agent-walkllc wants to merge 16 commits into
Conversation
Clarified scope decisions and added notes on IAM user retirement.
…amed sso instance from 'this' to sso_instance
rzkw
previously approved these changes
Oct 12, 2026
Owner
|
added inline comments in iam/main.tf |
…for dev-machine - force IMDSv2 (http_tokens required) to fix CKV_AWS_79 - add key pair from TF_VAR_ssh_public_key and SSH security group from operator CIDR - add instance role with AdministratorAccess and instance profile to fix CKV2_AWS_41 - skip CKV_AWS_8, CKV_AWS_135, CKV_AWS_126, CKV_AWS_382 with justifications (no EBS volumes, paid detailed monitoring, open outbound needed for a test box)
…y group - point subnet and route table at aws_vpc.vpc-1 (aws_vpc.this never existed; terraform validate failed) - add aws_default_security_group with no rules to fix CKV2_AWS_12 - skip CKV2_AWS_11 with justification: VPC flow logs are billed, noted in PR amendment
- attach IAMUserChangePassword to the admin group instead of the user (CKV_AWS_40) - remove SignInLocalDevelopmentAccess: with SSO configured, aws sso login is used and the policy only powers aws login with console credentials (checked AWS docs) - skip CKV_AWS_273 on both legacy IAM users (retirement in a later PR per plan) and CKV_AWS_274 on admin group and SSO permission set (rzkw requires full admin) - drop 5 import blocks whose resources are not in configuration anymore - rename deny-mutations.json to deny-changes.json to match the config reference (rename was missed in 3920dc8)
The CI deploy role intentionally keeps AdministratorAccess (root default in environments/test/variables.tf) so workflows can manage all test-environment resources; role trust is restricted to this repository via OIDC.
Lists the 14 findings, the 6 code fixes, and the 11 skipped checks with justifications (cost-driven, legacy users pending retirement, admin-by-design roles), plus the apply note for the new ec2 variables.
…review - add variable validation that blocks ssh_ingress_cidr 0.0.0.0/0 (Checkov cannot see through the variable, so the guard lives in Terraform) - reword CKV_AWS_8 and CKV_AWS_135 justifications: the root volume exists, the old text wrongly claimed there were no volumes
- state that the CI Checkov job scans the base branch (workflow defect found in review), so only the local scan is green today - CKV_AWS_274 skips are four, not three: add the EC2 dev-machine-role - align the CKV_AWS_8 and CKV_AWS_135 wording with the code justifications - point out that step 8 retires agent-walkllc only; rzkw-iam is a separate decision
7 of 14 tasks
Publishes the session transcript for the Checkov work on PR #15. Redacted before publishing: the session identifier, the signed log URL (it carried a live SAS signature and tenant id), and the account handles. Placeholders are role-based (<user>, <agent-user>) with a legend at the top so the text stays readable. The transcript held no email addresses, account IDs, account-scoped ARNs, state bucket names, or key material. AWS-managed policy ARNs are kept because they are public and carry no account id.
The report is published as part of a blog post, so it is rewritten as a standalone summary: the problem, the fixes, the justified skips, the bugs the scan never reached, the CI checkout defect, verification, and the lesson. The redaction discipline is kept: no handles, session ids, signed URLs, account ids, or key material appear, so no placeholders are needed.
rzkw
approved these changes
Oct 19, 2026
rzkw
previously approved these changes
Oct 23, 2026
…main.tf and ../test/variables.tf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Plan and Terraform draft for human + bot AWS identity access:
TerraformAdministratorpermission set. No long-lived access keys. Terraform runs through the SSO profile.agent-view-onlyIAM role from the SSO profile. The role getsViewOnlyAccessplus the existing deny-mutations policy, so the harness never holds access keys.Files:
docs/superpowers/plans/2026-09-26-human-bot-identity-access.md— dated plan with references.environments/test/iam/main.tf— adds Identity Center user, permission set, account assignment, and the agent role.environments/test/iam/variables.tf— adds sensitiverzkw_emailvariable (real email is passed viaTF_VAR_rzkw_email, never committed).One-time console bootstrap (outside Terraform): create the organization and enable the Identity Center organization instance. The AWS provider exposes the instance only as a data source.
Type of Change
Environment Impact
Checklist
Checkov scan amendment (2026-10-17)
The Checkov step failed 13 checks (14 with newer local Checkov). All are fixed in code: the local scan passes — 54 passed, 0 failed, 11 skipped.
Note: the CI Checkov job checks out the base branch instead of the PR head (workflow defect found during review), so its red result reflects
main, not this branch. The workflow fix must land onmainfirst; after a re-run the check turns green.Fixed in code
http_tokens = "required").dev-machine-role) attached to the instance.IAMUserChangePasswordmoved to theadmingroup;SignInLocalDevelopmentAccessremoved — per AWS docs it only powersaws loginwith console credentials, and with SSO the operator usesaws sso login.aws_default_security_groupwith no rules locks down the VPC default security group (this check is about the default security group, not routing).aws_vpc.thisreferences invpc/main.tf, missing policy fileagent-view-only-deny-changes.json, and 5 staleimportblocks.Skipped with justification (details in the plan doc)
root_block_device).agent-walkllc,rzkw-iamis a separate decision.TerraformAdministratorpermission set, CI deploy role, and the EC2dev-machine-roleare admin by design.Details:
docs/plans/2026-09-26-human-bot-identity-access.mdsection "Checkov Scan Amendment".Apply note: the
ec2/root now needsTF_VAR_ssh_public_keyandTF_VAR_ssh_ingress_cidr(open ranges like0.0.0.0/0are rejected by a variable validation). The instance is replaced on the next apply.Report:
reports/2026-10-19-aws-checkov-fix-failed-checks.md— condensed report of this work (under 500 words).