Repository navigation
Recompute policy evaluations when IAM changes land - #40
Merged
Merged
Conversation
Completion item 2 from the re-review (~/Documents/Testing/plans/2026-10-27-predictive-completion.md): a new admin grant or trust now produces its escalation paths within one incremental cycle instead of at the evaluator's scheduled hour, with explicit bounds on dispatch frequency. - Producer: the incremental collector signals when a batch could have moved an escalation. Any IAM node (IamRole/IamUser/IamGroup/IamPolicy*/ AccessKey) or IAM edge (TRUSTS/HAS_IAM_ROLE/ATTACHED_TO/MEMBER_OF/ HAS_ACCESS_KEY) marks the batch recompute-worthy (shared recomputeReasons), and the collector sends one best-effort message to the recompute FIFO queue — a missing queue or send failure never fails collection. The FIFO deduplication id (one per five-minute window) collapses bursts to a single message. - Worker: the `recompute-worker` runtime command runs as a Deployment (rendered only when the queue is wired) that long-polls the queue and re-runs the policy evaluator, so escalation paths and the likelihood on any path through them refresh within one incremental cycle; the hourly rule run still raises the corresponding issues. It refuses to evaluate more often than RECOMPUTE_MIN_INTERVAL_SECONDS (default 900, chart recomputeWorker.minIntervalSeconds) and deletes messages that arrive inside the interval as covered. A failed evaluation leaves its messages for SQS redelivery and the queue's DLQ; the scheduled evaluator remains the backstop. Reuses the policy-evaluator IRSA role (Neptune read/write), which gains receive/delete on the queue; the incremental collector role gains SendMessage. - Terraform: recompute FIFO queue + DLQ (visibility 900s to cover an evaluation, 4h retention, maxReceiveCount 3), grants, and recomputeQueueUrl flows into the chart's collection configmap. - Chart: recomputeWorker values (digest-pinned image, minIntervalSeconds, replicas, resources, pod annotations/labels), Deployment template gated on collection.recomputeQueueUrl, schema, network policy component, testdata. - Docs: README env table and Risk row, an ARCHITECTURE section on the two rate bounds and evaluator-only scope, an OPERATIONAL runbook, and CHANGELOG. The CDK path is not wired (documented). Why this is safe: the signal is additive and best-effort — collection never fails on it, and the worker deletes only messages it has covered. Both rate bounds are explicit (5-minute FIFO dedup window and a configurable minimum interval), a failed run retries before reaching the DLQ, and the worker reuses the existing evaluator role and permissions with no new write surface beyond the queue it drains.
The data-plane terraform test pins the policy-evaluator role's exact
action set ("Neptune actions and nothing else"); the recompute worker
reuses that role, so the pin now expects its queue drain rights too,
and the FIFO/CMK assertions cover the new queue and DLQ (including the
producer-set deduplication ids). The chart schema gives
collection.recomputeQueueUrl the same SQS URL pattern as the
incremental queue so malformed values are rejected at install time.
Why this is safe: test and schema tightening only — no policy or
runtime behavior changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A new admin grant or trust now produces its escalation paths within one incremental cycle instead of at the evaluator's scheduled hour, with explicit dispatch-frequency bounds. 25 files, +768/−8.
Producer — the incremental collector signals when a batch could have moved an escalation:
recomputeReasons(shared) marks any IAM node (IamRole/IamUser/IamGroup/IamPolicy*/AccessKey) or IAM edge (TRUSTS/HAS_IAM_ROLE/ATTACHED_TO/MEMBER_OF/HAS_ACCESS_KEY)SendMessageto the newrecomputeFIFO queue; missing queue or send failure never fails collectionWorker — new
recompute-workerruntime command, deployed as a Deployment (rendered only whencollection.recomputeQueueUrlis set):RECOMPUTE_MIN_INTERVAL_SECONDS(default 900, chartrecomputeWorker.minIntervalSeconds); messages inside the interval are deleted as coveredSendMessageTerraform/Chart — recommended queue + DLQ (visibility 900s, retention 4h), grants,
recomputeQueueUrlflows into the collection configmap; values/schema/network-policy/testdata updated. CDK path documented as not wired.Why this is safe
Test plan
npx jest --runInBand— 20 projects / 1813 tests passed (new: producer predicate + dedup windows, signal best-effort paths, worker interval/debounce/redelivery-on-failure/validation, runtime command validation + dispatch)npm run typecheck; full workspace lint;npm run format:checknpm run ci:build;npm run package:lambdas && npm run smoke:lambdas(9 archives)terraform fmt -check; chart schema parses; Deployment validation runs in CI (helm not installed locally)