Skip to content

fix: grant testing account access to sandbox layers#1141

Merged
duncanista merged 1 commit intomainfrom
jordan.gonzalez/grant-sandbox-layer-access
Mar 30, 2026
Merged

fix: grant testing account access to sandbox layers#1141
duncanista merged 1 commit intomainfrom
jordan.gonzalez/grant-sandbox-layer-access

Conversation

@duncanista
Copy link
Copy Markdown
Contributor

Summary

  • Sandbox layers were published without any resource-based permissions, blocking the self-monitoring account (093468662994) from accessing dev layer versions during CDK deployments.
  • When ADD_LAYER_VERSION_PERMISSIONS=0 (sandbox), the publish script now grants lambda:GetLayerVersion to the testing account instead of leaving the layer inaccessible.

Test plan

  • Trigger a sandbox layer publish and verify the layer version has a resource-based policy for 093468662994
  • Deploy lmi-dev-agent stack in self-monitoring repo using ENVIRONMENT=dev (pulls from layers-dev.json / sandbox account 425362996713)

Sandbox layers were published without any permissions, blocking
the self-monitoring account (093468662994) from deploying stacks
that reference dev layer versions.
@duncanista duncanista requested a review from a team as a code owner March 30, 2026 18:26
@duncanista duncanista requested review from Copilot and jchrostek-dd and removed request for Copilot March 30, 2026 18:26
@duncanista duncanista merged commit 2ee4912 into main Mar 30, 2026
46 of 50 checks passed
@duncanista duncanista deleted the jordan.gonzalez/grant-sandbox-layer-access branch March 30, 2026 18:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants