tegwick
86716ff263
FLEX-WP-0025-T01/T02: keep merged attributes, add registry/asserted namespaces later, and declare the remaining ceiling keys so no published allowlist is unbacked. T03 stays waiting on validate. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
65 lines
1.6 KiB
YAML
65 lines
1.6 KiB
YAML
id: ops-warden-ssh-certificates
|
|
system: ops-warden
|
|
resources:
|
|
- id: ssh-cert:actor/platform-steward
|
|
type: ssh-certificate
|
|
labels:
|
|
- ssh-signing
|
|
- adm
|
|
trust_zone: platform
|
|
owner: team:platform-security
|
|
attributes:
|
|
actor_id: platform-steward
|
|
actor_type: adm
|
|
allowed_subjects:
|
|
- platform-steward
|
|
- iam:platform-steward
|
|
allowed_principals:
|
|
- platform
|
|
- root
|
|
max_ttl_hours: 8
|
|
security_zone: z2-protected
|
|
security_zone_admission: satisfied
|
|
- id: ssh-cert:actor/ci-deploy-agent
|
|
type: ssh-certificate
|
|
labels:
|
|
- ssh-signing
|
|
- agt
|
|
trust_zone: platform
|
|
owner: team:platform-security
|
|
attributes:
|
|
actor_id: ci-deploy-agent
|
|
actor_type: agt
|
|
allowed_subjects:
|
|
- ci-deploy-agent
|
|
- iam:ci-deploy-agent
|
|
allowed_principals:
|
|
- deploy
|
|
- git
|
|
max_ttl_hours: 2
|
|
security_zone: z2-protected
|
|
security_zone_admission: satisfied
|
|
- id: ssh-cert:actor/backup-automation
|
|
type: ssh-certificate
|
|
labels:
|
|
- ssh-signing
|
|
- atm
|
|
trust_zone: platform
|
|
owner: team:platform-security
|
|
attributes:
|
|
actor_id: backup-automation
|
|
actor_type: atm
|
|
allowed_subjects:
|
|
- backup-automation
|
|
- iam:backup-automation
|
|
allowed_principals:
|
|
- backup
|
|
max_ttl_hours: 1
|
|
security_zone: z2-protected
|
|
security_zone_admission: satisfied
|
|
actions:
|
|
- sign
|
|
caring_profile: caring-0.4.0-rc2
|
|
metadata:
|
|
flex_auth_contract: resource-registration-v0
|
|
tenant: tenant:platform
|