feat(iam): grant SSM SendCommand on dashboard instance for auto-deploy#278
Merged
Conversation
…board instance Two new statements: - DashboardDeployViaSSM: ssm:SendCommand scoped to the dashboard instance (i-09b539c844515d549) + the AWS-RunShellScript document. - DashboardDeployPollCommand: ssm:GetCommandInvocation + ListCommandInvocations on `*` (no resource-level scoping available for these APIs). Enables alpha-engine-dashboard PR auto-deploy (separate PR opens once this lands). Mirrors the existing lambda-deploy pattern: PR merge → GHA workflow → SSM → instance pulls + restarts streamlit services → health check. OIDC trust already permits cipher813/alpha-engine-dashboard:main, so no trust-policy edit needed. Applied via infrastructure/iam/apply.sh pre-merge per the add-grant-PR-needs-apply-first discipline (drift check would block merge otherwise). Live drift check passes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends
github-actions-lambda-deploy(the cross-cutting OIDC role assumed by every alpha-engine-* GHA deploy workflow) withssm:SendCommandscoped to the dashboard instance (i-09b539c844515d549) + the AWS-RunShellScript document, plusssm:GetCommandInvocationfor polling.Unblocks alpha-engine-dashboard PR auto-deploy (separate PR opens once this merges). Pattern mirrors the existing lambda deploys: PR merge → GHA workflow → SSM → instance pulls + restarts streamlit services → health check.
Why this role, not a new one
github-actions-lambda-deployis already cross-cutting by design (perinfrastructure/iam/README.md), already includes infra-deploy actions (CloudFormation, SNS, scheduler, etc.) despite the name, and its OIDC trust already permitscipher813/alpha-engine-dashboard:main. Single role is the lower-ceremony choice for a 1-dev project. If the dashboard deploy ever needs blast-radius isolation, splitting is mechanical.Apply.sh ran pre-merge
Per the add-grant discipline ([[feedback_apply_sh_iam_drift_check_inverts_timing]]) — codified must match live before the drift-check CI can pass on this PR:
Test plan
🤖 Generated with Claude Code