coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Name the MAS backup application in the source bucket policy.
All checks were successful
CCR intake gate / gate (push) Successful in 15s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The founder supplied application id 25a4cbca-220e-40c0-9af5-6c7713000174.
Three statements allow only platform-pg/application-archives/mas/ and do
not grant object delete. The live policy was not changed.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
This commit is contained in:
codex 2026-11-02 10:46:30 +01:00
parent 7c38de3309
commit 363e63562b
4 changed files with 41 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml
View file

@ -103,7 +103,7 @@
"endpoint": "https://s3.nl-ams.scw.cloud",
"bucket": "railiance-platform-pg-backup",
"prefix": "platform-pg/application-archives/mas/",
"identity": "founder created IAM application mas-evidence-backup-primary in the console; application id is not recorded because this workstation has no Scaleway credential",
"identity": "IAM application mas-evidence-backup-primary 25a4cbca-220e-40c0-9af5-6c7713000174; no key stored; bucket policy source allows only platform-pg/application-archives/mas/ and withholds object delete",
"retained_delete": false
},
"risk": {

23
docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md
View file

@ -4,8 +4,9 @@ Prepared for RPF-WP-0070. The founder approved CCR-2026-0062 on 2026-11-02
as platform-owner and mas-owner. The Kubernetes binding is confirmed against
ServiceAccount `backup-primary-delivery` in namespace `mas`, which exists with
automount disabled. Delivery admission is still false. The OpenBao policy
and role were installed at 2026-11-02T09:02:50Z. No provider identity, value,
node file, offsite upload, or timer exists yet.
and role were installed at 2026-11-02T09:02:50Z. IAM application
`mas-evidence-backup-primary` is `25a4cbca-220e-40c0-9af5-6c7713000174`.
No key, value, node file, offsite upload, or timer exists yet.
The accepted shape is the email-connect ledger reader, CCR-2026-0037. The MAS
prefix is `platform-pg/application-archives/mas/` in bucket
@ -22,7 +23,7 @@ local. It is not an offsite object.
| Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas |
| ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding |
| Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created |
| Provider identity | application mas-evidence-backup-primary | founder created it in the console; this workstation still cannot list it, so its id is not recorded |
| Provider identity | application mas-evidence-backup-primary `25a4cbca-220e-40c0-9af5-6c7713000174` | id recorded; no API key stored |
Do not reuse the email-connect publisher or its node file. Object-storage IAM
is not prefix-scoped inside a project, so a later admission needs its own IAM
@ -37,14 +38,14 @@ and is not created here.
2. The policy and role are installed. The attended command finished at
2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission
stays false.
3. The founder created IAM application `mas-evidence-backup-primary` in the
console. Its id is not recorded yet: `scw iam application list` still
reports no credentials on this workstation. The next record is that id,
then the three prefix statements. Do not add a key to email-connect or to
a broad application.
4. Add three bucket-policy statements for that application, limited to
`platform-pg/application-archives/mas/`, with no object delete. Prove sibling
denial, retained-delete denial, and no IAM or bucket administration.
3. IAM application `mas-evidence-backup-primary` is
`25a4cbca-220e-40c0-9af5-6c7713000174`. Do not add a key to email-connect
or to a broad application.
4. The source bucket policy has three statements for that application,
limited to `platform-pg/application-archives/mas/`, with no object delete.
The live merge did not run: the local OpenBao token cannot read the
backup or bootstrap paths. Sibling, retained-delete, and administration
denials still require this application's own key.
5. Provision the pair atomically with KV CAS=0 under the pair-writer policy
extended to this one path. The single-field paste desk is unsuitable.
6. Record positive reader proof and negative denials, then set delivery

23
docs/object-storage/railiance-platform-pg-backup-policy.json
View file

@ -70,6 +70,29 @@
"Principal": {"SCW": "application_id:0eb0f958-77a4-4c70-9aa7-14ba46411415"},
"Action": ["s3:AbortMultipartUpload", "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:PutObject"],
"Resource": "railiance-platform-pg-backup/platform-pg/application-archives/email-connect/*"
},
{
"Sid": "MasEvidenceBackupProbe",
"Effect": "Allow",
"Principal": {"SCW": "application_id:25a4cbca-220e-40c0-9af5-6c7713000174"},
"Action": ["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration"],
"Resource": "railiance-platform-pg-backup",
"Condition": {"Bool": {"aws:SecureTransport": "true"}}
},
{
"Sid": "MasEvidenceBackupList",
"Effect": "Allow",
"Principal": {"SCW": "application_id:25a4cbca-220e-40c0-9af5-6c7713000174"},
"Action": ["s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListBucketVersions"],
"Resource": "railiance-platform-pg-backup",
"Condition": {"StringLike": {"s3:prefix": ["platform-pg/application-archives/mas/", "platform-pg/application-archives/mas/*"]}}
},
{
"Sid": "MasEvidenceBackupObjects",
"Effect": "Allow",
"Principal": {"SCW": "application_id:25a4cbca-220e-40c0-9af5-6c7713000174"},
"Action": ["s3:AbortMultipartUpload", "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:PutObject"],
"Resource": "railiance-platform-pg-backup/platform-pg/application-archives/mas/*"
}
]
}

9
workplans/RPF-WP-0070-mas-evidence-recovery.md
View file

@ -40,7 +40,7 @@ status: progress
priority: medium
needs_human: true
depends_on: [RPF-WP-0053-T05]
intervention_note: "CCR-2026-0062 is applied. The founder created IAM application mas-evidence-backup-primary. Its id is not recorded because this workstation has no Scaleway credential. Delivery admission stays false. Age-identity escrow remains separate."
intervention_note: "CCR-2026-0062 is applied. IAM application mas-evidence-backup-primary is 25a4cbca-220e-40c0-9af5-6c7713000174. The source bucket policy names that id under platform-pg/application-archives/mas/ with no object delete. No API key is stored. Delivery admission stays false. Age-identity escrow remains separate."
state_hub_task_id: "4f6484fb-8303-5dd5-94cb-b2622e1322c8"
```
@ -66,9 +66,10 @@ mas-owner. ServiceAccount `backup-primary-delivery` now exists in
namespace `mas` with automount disabled and no RoleBinding. The binding
is confirmed. Delivery admission stays false. The OpenBao policy and
role were installed at 2026-11-02T09:02:50Z by the silent reader script.
The founder created IAM application `mas-evidence-backup-primary` in the
console. This workstation still has no Scaleway credential, so the
application id is not recorded here. The KV pair and
IAM application `mas-evidence-backup-primary` is
`25a4cbca-220e-40c0-9af5-6c7713000174`. The source bucket policy allows
that id only under `platform-pg/application-archives/mas/` and does not
grant object delete. No API key is stored. The KV pair and
`/etc/mas-backup/primary.env` do not exist. Pair-custody lists still
name only coulomb-social and email-connect.
Design: `docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md`.