fix(cdk): allow-list JiraIntegration* secret in bootstrap policy (#402) (#403)

The custom least-privilege CFN execution-role policy (ADR-002) scopes
secretsmanager:CreateSecret to per-integration ARN prefixes, but the Jira
integration shipped without its pattern. A fresh `mise //cdk:bootstrap` +
deploy of current main therefore rolls back with:

  cdk-hnb659fds-cfn-exec-role is not authorized to perform
  secretsmanager:CreateSecret  (on JiraIntegrationWebhookSecre-...)

jira-integration.ts creates `new secretsmanager.Secret(this, 'WebhookSecret')`
under construct id `JiraIntegration`, which CloudFormation names
`JiraIntegrationWebhookSecre-...`, matching no allow-listed prefix.

Add `arn:aws:secretsmanager:*:*:secret:JiraIntegration*` to the SecretsManager
statement and regenerate the bootstrap artifacts (application.json,
bootstrap-template.yaml). Add the same pattern to the DEPLOYMENT_ROLES.md
golden source-of-truth (+ Starlight mirror) so the golden-baseline parity
test passes.

Add a regression guard in policies.test.ts asserting the allow-list carries a
pattern for every integration that creates a secret — the existing
service-prefix check can't catch a missing resource ARN (it's still
`secretsmanager:`), which is how this reached main.

Fixes #402

Co-authored-by: bgagent <bgagent@noreply.github.com>

Author: isadeks

cdk/bootstrap/bootstrap-template.yaml

@@ -1129,6 +1129,7 @@ Resources:
               - arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*
               - arn:aws:secretsmanager:*:*:secret:SlackIntegration*
               - arn:aws:secretsmanager:*:*:secret:LinearIntegration*
+              - arn:aws:secretsmanager:*:*:secret:JiraIntegration*
               - arn:aws:secretsmanager:*:*:secret:GitHubScreenshot*
               - arn:aws:secretsmanager:*:*:secret:bgagent/*
             Sid: SecretsManager

cdk/bootstrap/policies/application.json

@@ -205,6 +205,7 @@
         "arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*",
         "arn:aws:secretsmanager:*:*:secret:SlackIntegration*",
         "arn:aws:secretsmanager:*:*:secret:LinearIntegration*",
+        "arn:aws:secretsmanager:*:*:secret:JiraIntegration*",
         "arn:aws:secretsmanager:*:*:secret:GitHubScreenshot*",
         "arn:aws:secretsmanager:*:*:secret:bgagent/*"
       ],

cdk/src/bootstrap/policies/application.ts

@@ -246,6 +246,7 @@ export function applicationPolicy(): iam.PolicyDocument {
           'arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*',
           'arn:aws:secretsmanager:*:*:secret:SlackIntegration*',
           'arn:aws:secretsmanager:*:*:secret:LinearIntegration*',
+          'arn:aws:secretsmanager:*:*:secret:JiraIntegration*',
           'arn:aws:secretsmanager:*:*:secret:GitHubScreenshot*',
           'arn:aws:secretsmanager:*:*:secret:bgagent/*',
         ],

cdk/test/bootstrap/policies.test.ts

@@ -148,6 +148,38 @@ describe('IaCRole-ABCA-Application', () => {
       ]),
     );
   });
+
+  it('SecretsManager statement allow-lists a secret pattern for every integration that creates a secret', () => {
+    // Regression guard for #402: each integration construct that creates a
+    // Secrets Manager secret (GitHub token, Slack, Linear, Jira, GitHub
+    // screenshot) names it after its construct id, so the CFN exec role's
+    // scoped CreateSecret allow-list must carry a matching prefix. A missing
+    // pattern is invisible to the service-prefix check above (it's still
+    // `secretsmanager:`) but fails the deploy with AccessDenied at
+    // CreateSecret time. Jira shipped without its pattern; this locks the
+    // contract so the next integration can't repeat it.
+    const resolvedDoc = stack.resolve(doc);
+    const statements = resolvedDoc.Statement as Array<{
+      Sid: string;
+      Resource?: string | string[];
+    }>;
+    const secretsStatement = statements.find((s) => s.Sid === 'SecretsManager');
+    expect(secretsStatement).toBeDefined();
+
+    const resources = Array.isArray(secretsStatement!.Resource)
+      ? secretsStatement!.Resource
+      : [secretsStatement!.Resource];
+
+    for (const prefix of [
+      'GitHubTokenSecret',
+      'SlackIntegration',
+      'LinearIntegration',
+      'JiraIntegration',
+      'GitHubScreenshot',
+    ]) {
+      expect(resources).toContain(`arn:aws:secretsmanager:*:*:secret:${prefix}*`);
+    }
+  });
 });
 
 describe('IaCRole-ABCA-Observability', () => {

docs/design/DEPLOYMENT_ROLES.md

@@ -473,6 +473,7 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, SQS
         "arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*",
         "arn:aws:secretsmanager:*:*:secret:SlackIntegration*",
         "arn:aws:secretsmanager:*:*:secret:LinearIntegration*",
+        "arn:aws:secretsmanager:*:*:secret:JiraIntegration*",
         "arn:aws:secretsmanager:*:*:secret:GitHubScreenshot*",
         "arn:aws:secretsmanager:*:*:secret:bgagent/*"
       ]

docs/src/content/docs/architecture/Deployment-roles.md

@@ -477,6 +477,7 @@ DynamoDB tables, Lambda functions, API Gateway, Cognito, WAFv2, EventBridge, SQS
         "arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*",
         "arn:aws:secretsmanager:*:*:secret:SlackIntegration*",
         "arn:aws:secretsmanager:*:*:secret:LinearIntegration*",
+        "arn:aws:secretsmanager:*:*:secret:JiraIntegration*",
         "arn:aws:secretsmanager:*:*:secret:GitHubScreenshot*",
         "arn:aws:secretsmanager:*:*:secret:bgagent/*"
       ]