feat(iam)!: separate build workflow user from asset repositories + add S3 asset support

[agustincelentano]

What

Separates the shared build workflow IAM identity from the per-destination asset repository permission modules, and adds first-class support for S3 asset repositories (Lambda/bundle assets).

Until now the build workflow user (the IAM identity the CI uses to publish assets) was created inside infrastructure/aws/iam/ecr. That worked while ECR was the only destination, but Lambda assets publish to S3, and the same user needs S3 permissions. This PR extracts the identity into its own module and lets each destination grant permissions to a shared group.

Changes

New modules

• infrastructure/aws/iam/build-user — creates the shared build workflow user, its access key, and the asset-publishers group (the attachment point for per-destination policies). Exposes build_workflow_access_key_id/secret and group_name.
• infrastructure/aws/iam/s3-assets — grants s3:PutObject/s3:GetObject on an assets bucket to the build workflow group. Inputs: cluster_name, build_workflow_group_name, assets_bucket.
• nullplatform/asset/s3 — registers an S3 bucket as a nullplatform asset repository (nullplatform_provider_config of type s3-configuration), exposing it as aws.s3_assets_bucket. Input: bucket_name.

Modified

• infrastructure/aws/iam/ecr — no longer creates the user/access key/group/membership. Now only manages ECR permissions and attaches its policy to the group received via the new required input build_workflow_group_name. Removes the build_workflow_access_key_id/secret outputs.

⚠ BREAKING CHANGE (iam/ecr)

infrastructure/aws/iam/ecr changes its contract:

• New required input build_workflow_group_name.
• Removes outputs build_workflow_access_key_id and build_workflow_access_key_secret (now provided by build-user).
• No longer creates the build user, access key, group or membership.

Consumers must instantiate build-user, pass its group_name to ecr (and s3-assets), take the build credentials from build-user outputs, and migrate state to avoid recreating the IAM user (which would rotate the access keys and break CI):

tofu state mv 'module.ecr.aws_iam_user.nullplatform_build_workflow_user' \
              'module.build_user.aws_iam_user.nullplatform_build_workflow_user'
tofu state mv 'module.ecr.aws_iam_access_key.nullplatform_build_workflow_user_key' \
              'module.build_user.aws_iam_access_key.nullplatform_build_workflow_user_key'

The IAM group is renamed ecr-managers → asset-publishers (recreated; does not affect the user's keys). Full steps in infrastructure/aws/iam/build-user/README.md.

Notes

• The s3-configuration provider specification used by nullplatform/asset/s3 is platform-global (organization_id: null), so the module works across orgs. It is not present in this repo's seeders — worth confirming it ships in all installations before release.
• READMEs include hand-written TF_DOCS tables; the release pipeline regenerates them with terraform-docs.

Verification

• tofu fmt/validate pass on all three IAM modules and asset/s3; pre-commit hooks (fmt, validate, tofu test, commitlint) pass.
• Composition test (build-user → ecr + s3-assets via group_name) validates.
• Migrated end-to-end in a real implementation: state mv preserved the user (plan shows 0 changes on the user/access key), group recreated as asset-publishers with both ECR + S3 policies, asset/s3 imported the existing provider with no diff, and np asset push --type lambda now uploads the zip to S3 successfully.

🤖 Generated with Claude Code