check-ssm-zone validator: path conformance + key-zone drift (supersedes #95) #179

New issue

Closed

opened 2026-06-06 01:06:21 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-06 01:06:21 +00:00

Owner

Sibling of coilyco-bridge/agentic-os-kai#403 (SSM zone migration). Validator half. Supersedes the lost #95 deliverable (closed check-ssm-path — no surviving implementation on disk after the org migration).

Goal

A validator that guarantees every SSM param maps to exactly one sensitivity zone, both by path shape and by the actual KMS key wrapping it.

Schema: /coilysiren/<repo>/<zone>/<tail>

repo — lowercase slug [a-z0-9-]+
zone — public | private | admin (selects the KMS key; the IAM/crypto gate)
tail — freeform leaf

Two-layer check

Path conformance — name matches the schema, zone ∈ {public,private,admin}. (This is the original #95 ask, with the tier vocab redefined from {admin,write,read} to {public,private,admin} — read/write is now an IAM-action grant on the principal, not a path segment.)
Key↔zone agreement (drift) — the param's live KeyId (free from describe-parameters) resolves to the alias its zone segment demands. Catches the real failure mode: a /…/public/… param wrapped by aws/ssm or the admin key. On day one almost everything fails layer 2 — every non-admin param is currently on the default alias/aws/ssm. Clearing layer 2 IS the migration's definition-of-done.

Shape

Sibling to / share code with agentic-os-kai/scripts/ssm-drift.py, which already enumerates live params. Add KeyId to its describe-parameters --query.
Console script check-ssm-zone in agentic-os, registered in pyproject.toml, pytest-covered (collect all violations, don't fail-fast).
Follow-up: wire as a blocking pre-commit hook against the param source of truth (the #403 audit YAML, and/or terraform aws_ssm_parameter names).

**Sibling of** coilyco-bridge/agentic-os-kai#403 (SSM zone migration). Validator half. Supersedes the lost #95 deliverable (closed `check-ssm-path` — no surviving implementation on disk after the org migration). ## Goal A validator that guarantees **every SSM param maps to exactly one sensitivity zone**, both by path shape and by the actual KMS key wrapping it. Schema: `/coilysiren/<repo>/<zone>/<tail>` - `repo` — lowercase slug `[a-z0-9-]+` - `zone` — `public | private | admin` (selects the KMS key; the IAM/crypto gate) - `tail` — freeform leaf ## Two-layer check 1. **Path conformance** — name matches the schema, `zone ∈ {public,private,admin}`. (This is the original #95 ask, with the tier vocab redefined from `{admin,write,read}` to `{public,private,admin}` — read/write is now an IAM-action grant on the principal, not a path segment.) 2. **Key↔zone agreement (drift)** — the param's live `KeyId` (free from `describe-parameters`) resolves to the alias its zone segment demands. Catches the real failure mode: a `/…/public/…` param wrapped by `aws/ssm` or the admin key. **On day one almost everything fails layer 2** — every non-admin param is currently on the default `alias/aws/ssm`. Clearing layer 2 IS the migration's definition-of-done. ## Shape - Sibling to / share code with `agentic-os-kai/scripts/ssm-drift.py`, which already enumerates live params. Add `KeyId` to its `describe-parameters --query`. - Console script `check-ssm-zone` in `agentic-os`, registered in `pyproject.toml`, pytest-covered (collect all violations, don't fail-fast). - Follow-up: wire as a blocking pre-commit hook against the param source of truth (the #403 audit YAML, and/or terraform `aws_ssm_parameter` names).

coilysiren added the

label

2026-06-17 07:05:04 +00:00

coilysiren commented

2026-06-17 08:23:05 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:23:05 +00:00