coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record that the MAS backup IAM application exists.
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The founder created mas-evidence-backup-primary in the console. This
workstation still cannot read its id.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
This commit is contained in:
codex 2026-11-02 10:33:26 +01:00
parent 8d4d285643
commit 7c38de3309
3 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/credential-lane-designs/mas-evidence-backup-grant-2026-11-02.md
View file

@ -22,7 +22,7 @@ local. It is not an offsite object.
| Role | mas-backup-primary-workload-kv-read | installed for backup-primary-delivery in namespace mas |
| ServiceAccount | backup-primary-delivery in namespace mas | live, automount false, uid c0e5867b-b4be-49b7-94db-6aae0a6e566e; no RoleBinding |
| Node file | /etc/mas-backup/primary.env, root:root 0600, directory 0700 | not created |
| Provider identity | proposed application mas-evidence-backup-primary | not created; this workstation has no Scaleway credential |
| Provider identity | application mas-evidence-backup-primary | founder created it in the console; this workstation still cannot list it, so its id is not recorded |
Do not reuse the email-connect publisher or its node file. Object-storage IAM
is not prefix-scoped inside a project, so a later admission needs its own IAM
@ -37,10 +37,11 @@ and is not created here.
2. The policy and role are installed. The attended command finished at
2026-11-02T09:02:50Z and wrote a metadata receipt. Delivery admission
stays false.
3. In the Scaleway console, create a new IAM application named
`mas-evidence-backup-primary`. Do not add a key to email-connect or to a
broad application. Then say that the application exists. This workstation
has no Scaleway credential, so it cannot create the application or its key.
3. The founder created IAM application `mas-evidence-backup-primary` in the
console. Its id is not recorded yet: `scw iam application list` still
reports no credentials on this workstation. The next record is that id,
then the three prefix statements. Do not add a key to email-connect or to
a broad application.
4. Add three bucket-policy statements for that application, limited to
`platform-pg/application-archives/mas/`, with no object delete. Prove sibling
denial, retained-delete denial, and no IAM or bucket administration.