Repository navigation
Prepare forms-processor-v6 develop deployment with OIDC v2.0.5 - #12
Merged
Merged
Conversation
jmgasper
force-pushed
the
security/ecs-oidc-deployment
branch
from
November 3, 2026 21:28
b613823 to
c6cbd3c
Compare
jmgasper
changed the title
jmgasper
force-pushed
the
security/ecs-oidc-deployment
branch
from
November 4, 2026 10:22
c6cbd3c to
66e90f6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move the ECS deployment migration onto current
developand pin tc-deploy-scripts v2.0.5, fetched by tag and verified againstbff574ab5c0b46773e25d2af1eff76675fba2ba5. Build jobs remain separate from the deployment context; production remains approval-gated on its existing production branch. Current dev application/dependency fixes are preserved. The credential-free builder rejects committed.npmrcfiles. Preserve the existing local compatibility dependencies with explicit--install-links=truenpm options instead; do not reintroduce credential-capable npm configuration files. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts.Per-service OIDC replaces the Auth0/SSM broker path. The deployment role, matching boundary and STS session explicitly deny Parameter Store, Secrets Manager, KMS decryption and role chaining. Runtime roles and secret references remain owned by ECS infrastructure. Matching private IAM policies include the region-restricted Inspector list permissions required for enhanced scanning; those scan-metadata APIs require Resource
*.Draft: dev resource identities are verified; infrastructure prerequisites remain before merge.
deploy/dev.jsonand matching private IAM templates were prepared from live AWS inventory. No resources or service capacity were changed. Remaining prerequisites:IAM templates, baselines and provisioning status remain in the private service directory. No infrastructure files have been reintroduced into the application PR history.
Validation: CircleCI CLI configuration validation; manifest/policy/trust consistency where project identity is available; shell syntax and git diff checks; service-specific Python deployment regressions in the pinned executor. Shared suite v2.0.5 has 82 passing tests. PR checks will report application builds separately. Live OIDC, functional smoke, rollback and wrong-project/ref tests remain rollout acceptance gates.