Repository navigation

sec(iac/aws): drop unconditioned account-wide KMS data-plane grant from deploy role - #2078

Closed

cristim wants to merge 3 commits into

mainfrom

fix/1969-kms-deploy-role-scope

Commits on Sep 8, 2026

sec(iac/aws): drop unconditioned account-wide KMS data-plane grant from deploy role

cristim
and
ruvnet
committed
dfbace6
fix(iac/aws): fail closed on unreadable KMS Action and non-scoping Condition

cristim
and
ruvnet
committed
583a013
fix(iac/aws): close remaining KMS guard bypasses found in adversarial review

cristim
and
ruvnet
committed
bacd4e1