Tags as primitive, alert enrichment, budget enforcement, RDS module by Alexanderamiri · Pull Request #77 · javaBin/platform · GitHub
Skip to content

Tags as primitive, alert enrichment, budget enforcement, RDS module - #77

Merged
Alexanderamiri merged 2 commits into
mainfrom
feat/tags-alerts-rds-budget
Mar 17, 2026
Merged

Tags as primitive, alert enrichment, budget enforcement, RDS module#77
Alexanderamiri merged 2 commits into
mainfrom
feat/tags-alerts-rds-budget

Conversation

@Alexanderamiri

@Alexanderamiri Alexanderamiri commented Mar 17, 2026

Copy link
Copy Markdown
Member

Summary

Foundation changes to make tags a first-class primitive for ABAC, cost attribution, and auditability. Plus alert enrichment, budget enforcement, and RDS support.

Tags as primitive

  • Tag schema: 5 static tags (team, service, repo, environment, managed-by) via provider default_tags. Dropped project tag (always "javabin", zero information).
  • Resource tagger Lambda: EventBridge-triggered (wildcard {"prefix": "aws."} match), auto-tags created-by + commit from CloudTrail session names. Tags added via AWS API — invisible to Terraform, no drift.
  • Cost allocation tags: Activated for all 7 tag keys so Cost Explorer can group by team/service.
  • ECS tag propagation: propagate_tags = SERVICE so Fargate task costs are attributed to teams.

Alert enrichment (Task A)

  • CI session names changed to {actor}-{sha8}-{run_id} in all 4 workflows.
  • slack_alert parse_identity() extracts actor/commit from new format.
  • Cost reports (daily + weekly) include per-team tag breakdown.

Budget enforcement (Task D)

  • New budget-enforcer Lambda: scales ECS services to desired_count=0 at 200% budget.
  • team_provisioner adds 200% notification alongside existing 80%.

RDS module (Task E)

  • New service-rds module: PostgreSQL with Secrets Manager password, private subnets, ECS SG ingress.
  • registry.py + expand-modules.py updated with engine-based routing (postgres vs dynamodb).

IAM restructure

  • Team deny policy: ABAC (ARN-scoped) where AWS supports tags (SNS, S3, ECS, ELB). Explicit denies only where AWS lacks tag conditions (EC2 VPC, GuardDuty, SecurityHub, Config, CloudTrail, Organizations, IAM).
  • service-role module: configurable trusted_services (ECS/EC2/Lambda).
  • EventBridge resource-tagger uses wildcard; monitoring rules keep curated lists (documented volume rationale).

Test plan

  • terraform plan shows tag migration (project removed, service+repo added) on existing resources
  • After apply: resources show 5 Terraform-managed tags in console
  • Trigger CI run → Slack alert shows actor name + commit link
  • Next day: Cost Explorer GroupBy team returns per-team costs
  • Create test resource → resource-tagger tags it within 15 min
  • Invoke budget-enforcer with test payload → ECS service scales to 0
  • Test app with engine: postgres in app.yaml → RDS created in private subnet

@Alexanderamiri
Tags as primitive, alert enrichment, budget enforcement, RDS module (#77
3b68a5d 
)

Foundation changes:
- Tag schema: drop project tag, add repo tag. 5 static tags (team, service,
  repo, environment, managed-by) applied via provider default_tags.
- Resource tagger Lambda: EventBridge-triggered (wildcard prefix match),
  auto-tags created-by + commit from CloudTrail session names. Tags added
  via AWS API outside Terraform — no drift or plan noise.
- Cost allocation tags activated for all 7 tag keys.
- ECS tag propagation: enable_ecs_managed_tags + propagate_tags = SERVICE
  so Fargate task-level compute costs are attributed to teams.

Alert enrichment:
- CI session names changed to {actor}-{sha8}-{run_id} in all 4 workflows.
- slack_alert parse_identity() updated to extract actor/commit from new format.
- Cost reports (daily + weekly) now include per-team tag breakdown.

Budget enforcement:
- New budget_enforcer Lambda: scales ECS services to desired_count=0 when
  team exceeds 200% of budget. Triggered via SNS from AWS Budgets.
- team_provisioner sync_budget adds 200% notification alongside existing 80%.

RDS module:
- New service-rds module: PostgreSQL with Secrets Manager password,
  private subnet placement, security group scoped to ECS tasks SG.
- Registry + expand-modules updated with engine-based routing (postgres vs dynamodb).

IAM restructure:
- Team deny policy: ABAC (ARN-scoped) where AWS supports tags (SNS, S3,
  ECS, ELB). Explicit denies only where AWS lacks tag conditions (EC2 VPC,
  GuardDuty, SecurityHub, Config, CloudTrail, Organizations, IAM users).
- Service-role module: configurable trusted_services (ECS/EC2/Lambda).
- EventBridge monitoring rules: documented volume rationale for curated lists.
@Alexanderamiri
Update docs for new Lambdas, RDS module, tag schema, ABAC changes
83230af 
- CLAUDE.md: add budget-enforcer, resource-tagger, ci-broker to Lambda
  table and alert routing diagram. Update function count to 11.
- lambda-functions.md: add budget-enforcer and resource-tagger sections,
  update team-provisioner from stub to working status.
- reusable-modules.md: add service-rds module, document trusted_services
  on service-role, add ECS tag propagation note.
- platform-modules.md: update Lambda count, add cost allocation tags.
@Alexanderamiri Alexanderamiri mentioned this pull request Mar 17, 2026
Merged
@github-actions

github-actions Bot commented Mar 17, 2026

Copy link
Copy Markdown

@Alexanderamiri
Alexanderamiri merged commit 111106f into main Mar 17, 2026
3 checks passed
@Alexanderamiri
Alexanderamiri deleted the feat/tags-alerts-rds-budget branch March 17, 2026 19:18
@Alexanderamiri Alexanderamiri mentioned this pull request Mar 17, 2026
Merged
2 tasks
Alexanderamiri added a commit that referenced this pull request Mar 17, 2026
@Alexanderamiri
Fix apply: permission boundary on new Lambda roles, defer cost tags (#78
3641f24 
)

## Summary
Fixes apply failure from #77.

- **Permission boundary**: `budget-enforcer` and `resource-tagger` IAM
roles were missing `permissions_boundary`. The self-replicating boundary
on `ci-infra` blocks role creation without it.
- **Cost allocation tags**: `repo`, `created-by`, `commit` tags don't
exist on any billed resource yet — AWS rejects activation. Defer to
phase 2/3 (activate after resources with those tags exist).

## Test plan
- [ ] `terraform plan` shows 2 role modifications (add boundary) + 3 tag
removals
- [ ] Apply succeeds
@Alexanderamiri Alexanderamiri mentioned this pull request Mar 17, 2026
Merged
4 tasks
Alexanderamiri added a commit that referenced this pull request Mar 17, 2026
@Alexanderamiri
Protect platform security groups in permission boundary (#81)
1980d74 
## Summary
Adds `DenyPlatformSecurityGroups` to the developer permission boundary.
Denies modify/delete operations on security groups named `javabin-*`
(platform ALB and ECS tasks SGs).

Teams can still create their own SGs (needed for RDS module — e.g.,
`moresleep-rds-sg`).

Addresses security review finding from #77: SG operations were removed
from the team deny policy to support RDS. The boundary now protects
platform SGs while allowing team SG creation.

## Test plan
- [ ] `terraform plan` shows boundary policy update
- [ ] Apply succeeds
- [ ] Team role cannot modify `javabin-alb-sg` or `javabin-ecs-tasks-sg`
- [ ] Team role can create `{app}-rds-sg` via expanded TF
Alexanderamiri added a commit that referenced this pull request May 9, 2026
@Alexanderamiri
Tags as primitive, alert enrichment, budget enforcement, RDS module (#77
f9fae95 
)

## Summary

Foundation changes to make tags a first-class primitive for ABAC, cost
attribution, and auditability. Plus alert enrichment, budget
enforcement, and RDS support.

### Tags as primitive
- **Tag schema**: 5 static tags (team, service, repo, environment,
managed-by) via provider `default_tags`. Dropped `project` tag (always
"javabin", zero information).
- **Resource tagger Lambda**: EventBridge-triggered (wildcard
`{"prefix": "aws."}` match), auto-tags `created-by` + `commit` from
CloudTrail session names. Tags added via AWS API — invisible to
Terraform, no drift.
- **Cost allocation tags**: Activated for all 7 tag keys so Cost
Explorer can group by team/service.
- **ECS tag propagation**: `propagate_tags = SERVICE` so Fargate task
costs are attributed to teams.

### Alert enrichment (Task A)
- CI session names changed to `{actor}-{sha8}-{run_id}` in all 4
workflows.
- `slack_alert` `parse_identity()` extracts actor/commit from new
format.
- Cost reports (daily + weekly) include per-team tag breakdown.

### Budget enforcement (Task D)
- New `budget-enforcer` Lambda: scales ECS services to `desired_count=0`
at 200% budget.
- `team_provisioner` adds 200% notification alongside existing 80%.

### RDS module (Task E)
- New `service-rds` module: PostgreSQL with Secrets Manager password,
private subnets, ECS SG ingress.
- `registry.py` + `expand-modules.py` updated with engine-based routing
(`postgres` vs `dynamodb`).

### IAM restructure
- Team deny policy: ABAC (ARN-scoped) where AWS supports tags (SNS, S3,
ECS, ELB). Explicit denies only where AWS lacks tag conditions (EC2 VPC,
GuardDuty, SecurityHub, Config, CloudTrail, Organizations, IAM).
- `service-role` module: configurable `trusted_services`
(ECS/EC2/Lambda).
- EventBridge resource-tagger uses wildcard; monitoring rules keep
curated lists (documented volume rationale).

## Test plan
- [ ] `terraform plan` shows tag migration (project removed,
service+repo added) on existing resources
- [ ] After apply: resources show 5 Terraform-managed tags in console
- [ ] Trigger CI run → Slack alert shows actor name + commit link
- [ ] Next day: Cost Explorer GroupBy `team` returns per-team costs
- [ ] Create test resource → resource-tagger tags it within 15 min
- [ ] Invoke budget-enforcer with test payload → ECS service scales to 0
- [ ] Test app with `engine: postgres` in app.yaml → RDS created in
private subnet
Alexanderamiri added a commit that referenced this pull request May 9, 2026
@Alexanderamiri
Fix apply: permission boundary on new Lambda roles, defer cost tags (#78
026a42a 
)

## Summary
Fixes apply failure from #77.

- **Permission boundary**: `budget-enforcer` and `resource-tagger` IAM
roles were missing `permissions_boundary`. The self-replicating boundary
on `ci-infra` blocks role creation without it.
- **Cost allocation tags**: `repo`, `created-by`, `commit` tags don't
exist on any billed resource yet — AWS rejects activation. Defer to
phase 2/3 (activate after resources with those tags exist).

## Test plan
- [ ] `terraform plan` shows 2 role modifications (add boundary) + 3 tag
removals
- [ ] Apply succeeds
Alexanderamiri added a commit that referenced this pull request May 9, 2026
@Alexanderamiri
Protect platform security groups in permission boundary (#81)
867c2dc 
## Summary
Adds `DenyPlatformSecurityGroups` to the developer permission boundary.
Denies modify/delete operations on security groups named `javabin-*`
(platform ALB and ECS tasks SGs).

Teams can still create their own SGs (needed for RDS module — e.g.,
`moresleep-rds-sg`).

Addresses security review finding from #77: SG operations were removed
from the team deny policy to support RDS. The boundary now protects
platform SGs while allowing team SG creation.

## Test plan
- [ ] `terraform plan` shows boundary policy update
- [ ] Apply succeeds
- [ ] Team role cannot modify `javabin-alb-sg` or `javabin-ecs-tasks-sg`
- [ ] Team role can create `{app}-rds-sg` via expanded TF
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Alexanderamiri