OIDC IAM policy for CI/CD Deployments

[sjoshi-jpl]

💡 Description

Draft a more restrictive OIDC policy for CI/CD deployments in MCP. This is a replacement policy for current MCP OIDC policy in Dev.

Sub-tasks

• Test policy with registry-api
• Test policy with s3-browser

[sjoshi-jpl]

@tloubrieu-jpl @viviant100 I've provided a more restrictive policy to Andrew from SA over Slack. They need to review it and configure it for the OIDC IAM role. If any changes are required, kindly work with Andrew to add/remove permissions.

[sjoshi-jpl]

Refactor policy provided to SA team with resource blocks

[tloubrieu-jpl]

Ready for the SA's to deploy.

[tloubrieu-jpl]

Andrew will setup a call Wednesday on that.

[sjoshi-jpl]

Sagar to work with Paul from SA team to add prefix conditions instead of tags in OIDC policy.

[tloubrieu-jpl]

Sagar works on a IAM policy script which uses the prefix of ARN to filter the resources which can be deployed.

[sjoshi-jpl]

Policy updated as requested by SA team with resource ARNs and prefixes. SA review in progress.

[jordanpadams]

@sjoshi-jpl added 2 sub-tasks to issue above