feat: org-wide S3-lister role, created by CI

[nbrieussel]

Context

First IAM role created by the CI (the aws-github-oidc role from #32) instead of by a human — exercising the privilege-escalation-safe role-creation flow end to end. Triggered from the remote: apply on push to main.

What it creates

s3-lister-role/ — a read-only S3 lister (AmazonS3ReadOnlyAccess, same access the original GitHub Action had), assumable by anyone in the AWS Organization:

trust_policy_permissions = {
  OrgWideAssume = {
    actions    = ["sts:AssumeRole"]
    principals = [{ type = "AWS", identifiers = ["*"] }]
    condition  = [{ test = "StringEquals", variable = "aws:PrincipalOrgID", values = [var.org_id] }]
  }
}

No account IDs hardcoded — the aws:PrincipalOrgID condition admits every (and only) caller whose creds belong to org o-f9lb1e5es9.

Honours the boundary contract

The role sits under the managed path and carries the permissions_boundary — the two conditions the CI grant requires, or the apply is denied. role_path is fed in CI from ${{ github.repository }}.

GitOps workflow

.github/workflows/s3-lister-role.yml assumes the CI role via OIDC (no static keys) and:

• PR → terraform plan (this PR will show the role to be created)
• push to main → terraform apply

Also

Wired s3-lister-role into the lock-check matrix, the mise lock task, and CLAUDE.md — and added aws-github-oidc, which was missing from the docs/lock list.

How to assume it (once applied)

aws sts assume-role \
  --role-arn "$(terraform -chdir=s3-lister-role output -raw role_arn)" \
  --role-session-name demo

🤖 Generated with Claude Code