Protect platform security groups in permission boundary (#81)

Alexanderamiri · web-flow · commit 1980d7443e48 · 2026-03-17T21:25:58.000Z
## Summary Adds `DenyPlatformSecurityGroups` to the developer permission boundary. Denies modify/delete operations on security groups named `javabin-*` (platform ALB and ECS tasks SGs). Teams can still create their own SGs (needed for RDS module — e.g., `moresleep-rds-sg`). Addresses security review finding from #77: SG operations were removed from the team deny policy to support RDS. The boundary now protects platform SGs while allowing team SG creation. ## Test plan - [ ] `terraform plan` shows boundary policy update - [ ] Apply succeeds - [ ] Team role cannot modify `javabin-alb-sg` or `javabin-ecs-tasks-sg` - [ ] Team role can create `{app}-rds-sg` via expanded TF
diff --git a/terraform/platform/iam/boundary.tf b/terraform/platform/iam/boundary.tf
@@ -157,6 +157,33 @@ resource "aws_iam_policy" "developer_boundary" {
         Resource = "*"
       },
 
+      ########################################################################
+      # Protect platform security groups
+      #
+      # Teams CAN create security groups (needed for RDS, custom services).
+      # Teams CANNOT modify or delete platform-owned security groups.
+      # Platform SGs are named javabin-* (e.g., javabin-alb-sg, javabin-ecs-tasks-sg).
+      # App SGs use app-name prefix (e.g., moresleep-rds-sg).
+      ########################################################################
+      {
+        Sid    = "DenyPlatformSecurityGroups"
+        Effect = "Deny"
+        Action = [
+          "ec2:DeleteSecurityGroup",
+          "ec2:AuthorizeSecurityGroupIngress",
+          "ec2:RevokeSecurityGroupIngress",
+          "ec2:AuthorizeSecurityGroupEgress",
+          "ec2:RevokeSecurityGroupEgress",
+          "ec2:ModifySecurityGroupRules",
+        ]
+        Resource = "arn:aws:ec2:${var.region}:${var.aws_account_id}:security-group/*"
+        Condition = {
+          StringLike = {
+            "ec2:ResourceTag/Name" = "${var.project}-*"
+          }
+        }
+      },
+
       ########################################################################
       # Deny platform ECS cluster, ALB, ACM certs
       ########################################################################
