fix(cdk): refresh bootstrap policies for current stack deploy (#350) (#351)

Least-privilege bootstrap v1.2.0 was missing IAM for integration secrets,
SQS DLQs, CloudFront OAC, Lambda layers, event-source mappings, and app S3
buckets — causing mid-deploy AccessDenied on custom bootstrap. Adds a
resource-action map and synth-coverage test, updates DEPLOYMENT_ROLES.md,
and documents the check in review_pr.

Co-authored-by: bgagent <bgagent@noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

.abca/commands/review_pr.md

@@ -71,6 +71,28 @@ Then apply principal-architect judgment over the diff:
   together and parity fixtures were refreshed.
 - **Security & least privilege** — IAM scoping, Cedar HITL gates, secrets handling, path-
   traversal guards, input validation. Fail closed.
+- **Bootstrap policy coverage (CDK deploy IAM)** — When the PR adds or changes constructs,
+  stacks, or handlers that introduce new CloudFormation resource types (new AWS services,
+  `AWS::SQS::Queue`, `AWS::CloudFront::*`, `AWS::SecretsManager::Secret`, Lambda layers,
+  application S3 buckets, etc.), verify the least-privilege bootstrap bundle was updated in
+  the **same PR**:
+  1. `cdk/src/bootstrap/policies/*.ts` — new actions and resource ARN patterns on the
+     CloudFormation execution role.
+  2. `cdk/src/bootstrap/resource-action-map.ts` — entry for each new CFN type (minimum
+     create-time IAM actions).
+  3. `BOOTSTRAP_VERSION` bumped in `cdk/src/bootstrap/version.ts` (minor when adding
+     permissions) and artifacts regenerated (`mise //cdk:bootstrap:generate` → committed
+     `cdk/bootstrap/policies/*.json`, `bootstrap-template.yaml`, `BOOTSTRAP_HASH`).
+  4. `docs/design/DEPLOYMENT_ROLES.md` golden baseline updated (required by
+     `cdk/test/bootstrap/golden-baseline.test.ts`).
+  5. `cdk/test/bootstrap/synth-coverage.test.ts` passes — run
+     `mise //cdk:test -- test/bootstrap/synth-coverage` or the full bootstrap suite.
+     **Flag as blocking** if constructs changed but bootstrap policies, the action map, or
+     version/artifacts were not updated. Missing ARN patterns (action present but resource
+     too narrow) are a common gap — check secret/queue/bucket naming against the patterns
+     in `application.ts` / `observability.ts`, not just action presence.
+  See [ADR-002](../../docs/decisions/ADR-002-least-privilege-bootstrap-policies.md) and
+  issue #350 for the failure mode this prevents.
 - **AWS / CDK quality** — Prefer L2 constructs, sane removal policies, no hardcoded ARNs/account
   IDs, cdk-nag clean. Watch for cost and operational footguns.
 - **Tests** — Are unit tests added/updated under the matching `*/test/` tree? Do they cover the
@@ -126,7 +148,8 @@ Summarize as a principal architect would in a PR review. Structure the output:
 3. **Blocking issues** — Numbered, each with `file:line`, the risk, and a suggested fix.
 4. **Non-blocking suggestions / nits** — Clearly separated.
 5. **Documentation** — What was updated, what is missing, mirror-sync status.
-6. **Tests & CI** — Coverage assessment and check status.
+6. **Tests & CI** — Coverage assessment and check status. For CDK construct/stack changes,
+   explicitly note bootstrap synth-coverage status (pass / not applicable / missing updates).
 7. **Review agents run** — List each plugin/agent you invoked (Stage 3) and, for any in-scope
    agent you omitted, the one-line reason. This section is required — its absence means the
    mandatory plugin step was skipped.

cdk/bootstrap/BOOTSTRAP_HASH

@@ -1 +1 @@
-a24d14dde94c546fdf94c7839492e92f612ae91def4660aaacab48d8e8da3146
+b0501c8a57f20e4b5bf50d6fe8bbb934310adc4b64480228565d8392a19d1503

cdk/bootstrap/BOOTSTRAP_VERSION

@@ -1 +1 @@
-1.1.0
+1.2.0

cdk/bootstrap/bootstrap-template.yaml

@@ -1,7 +1,7 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # This template is generated by: npx tsx scripts/generate-bootstrap-template.ts
-# ABCA Bootstrap Policy Version: 1.1.0
-# ABCA Bootstrap Policy Hash: a24d14dde94c546fdf94c7839492e92f612ae91def4660aaacab48d8e8da3146
+# ABCA Bootstrap Policy Version: 1.2.0
+# ABCA Bootstrap Policy Hash: b0501c8a57f20e4b5bf50d6fe8bbb934310adc4b64480228565d8392a19d1503
 #
 # Based on the default CDK bootstrap template with the following modifications:
 #   - BootstrapVariant set to "ABCA: Least-Privilege Bootstrap"
@@ -626,14 +626,11 @@ Resources:
       Policies:
         - PolicyDocument:
             Statement:
-              - Sid: CloudFormationPermissions
+              - Sid: DeployPermissions
                 Effect: Allow
                 Action:
                   - cloudformation:CreateChangeSet
                   - cloudformation:DeleteChangeSet
-                  - cloudformation:DescribeChangeSet
-                  - cloudformation:DescribeStacks
-                  - cloudformation:DescribeEvents
                   - cloudformation:ExecuteChangeSet
                   - cloudformation:CreateStack
                   - cloudformation:UpdateStack
@@ -673,12 +670,9 @@ Resources:
                 Effect: Allow
               - Sid: CliPermissions
                 Action:
-                  - cloudformation:DescribeStackEvents
-                  - cloudformation:GetTemplate
                   - cloudformation:DeleteStack
                   - cloudformation:UpdateTerminationProtection
                   - sts:GetCallerIdentity
-                  - cloudformation:GetTemplateSummary
                 Resource: '*'
                 Effect: Allow
               - Sid: CliStagingBucket
@@ -701,14 +695,12 @@ Resources:
                 Effect: Allow
                 Action:
                   - cloudformation:CreateStackRefactor
-                  - cloudformation:DescribeStackRefactor
                   - cloudformation:ExecuteStackRefactor
-                  - cloudformation:ListStackRefactorActions
-                  - cloudformation:ListStackRefactors
-                  - cloudformation:ListStacks
                 Resource: '*'
             Version: '2012-10-17'
           PolicyName: default
+      ManagedPolicyArns:
+        - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/AWSCloudFormationReadOnlyAccess
       RoleName:
         Fn::Sub: cdk-${Qualifier}-deploy-role-${AWS::AccountId}-${AWS::Region}
       Tags:
@@ -794,7 +786,7 @@ Resources:
       Type: String
       Name:
         Fn::Sub: /cdk-bootstrap/${Qualifier}/version
-      Value: '30'
+      Value: '32'
   IaCRoleABCAInfrastructure:
     Type: AWS::IAM::ManagedPolicy
     Properties:
@@ -1013,11 +1005,23 @@ Resources:
               - lambda:GetRuntimeManagementConfig
               - lambda:ListVersionsByFunction
               - lambda:InvokeFunction
+              - lambda:PublishLayerVersion
+              - lambda:DeleteLayerVersion
+              - lambda:GetLayerVersion
             Effect: Allow
             Resource:
               - arn:aws:lambda:*:*:function:backgroundagent-dev-*
               - arn:aws:lambda:*:*:function:backgroundagent-dev-AWS*
+              - arn:aws:lambda:*:*:layer:*
             Sid: Lambda
+          - Action:
+              - lambda:CreateEventSourceMapping
+              - lambda:DeleteEventSourceMapping
+              - lambda:UpdateEventSourceMapping
+              - lambda:GetEventSourceMapping
+            Effect: Allow
+            Resource: '*'
+            Sid: LambdaEventSourceMappings
           - Action:
               - apigateway:POST
               - apigateway:GET
@@ -1080,6 +1084,33 @@ Resources:
             Effect: Allow
             Resource: arn:aws:events:*:*:rule/backgroundagent-dev-*
             Sid: EventBridge
+          - Action:
+              - sqs:CreateQueue
+              - sqs:DeleteQueue
+              - sqs:GetQueueAttributes
+              - sqs:SetQueueAttributes
+              - sqs:TagQueue
+              - sqs:UntagQueue
+              - sqs:GetQueueUrl
+              - sqs:ListQueueTags
+            Effect: Allow
+            Resource: arn:aws:sqs:*:*:backgroundagent-dev-*
+            Sid: SQS
+          - Action:
+              - cloudfront:CreateDistribution
+              - cloudfront:UpdateDistribution
+              - cloudfront:DeleteDistribution
+              - cloudfront:GetDistribution
+              - cloudfront:TagResource
+              - cloudfront:UntagResource
+              - cloudfront:ListTagsForResource
+              - cloudfront:CreateOriginAccessControl
+              - cloudfront:UpdateOriginAccessControl
+              - cloudfront:DeleteOriginAccessControl
+              - cloudfront:GetOriginAccessControl
+            Effect: Allow
+            Resource: '*'
+            Sid: CloudFront
           - Action:
               - secretsmanager:CreateSecret
               - secretsmanager:DeleteSecret
@@ -1096,6 +1127,10 @@ Resources:
             Resource:
               - arn:aws:secretsmanager:*:*:secret:backgroundagent-*
               - arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*
+              - arn:aws:secretsmanager:*:*:secret:SlackIntegration*
+              - arn:aws:secretsmanager:*:*:secret:LinearIntegration*
+              - arn:aws:secretsmanager:*:*:secret:GitHubScreenshot*
+              - arn:aws:secretsmanager:*:*:secret:bgagent/*
             Sid: SecretsManager
           - Action: secretsmanager:GetRandomPassword
             Effect: Allow
@@ -1180,6 +1215,24 @@ Resources:
               - arn:aws:s3:::cdk-hnb659fds-assets-*
               - arn:aws:s3:::cdk-hnb659fds-assets-*/*
             Sid: S3CDKAssets
+          - Action:
+              - s3:CreateBucket
+              - s3:DeleteBucket
+              - s3:PutBucketPolicy
+              - s3:DeleteBucketPolicy
+              - s3:PutBucketPublicAccessBlock
+              - s3:GetBucketPublicAccessBlock
+              - s3:PutEncryptionConfiguration
+              - s3:PutLifecycleConfiguration
+              - s3:GetBucketLocation
+              - s3:ListBucket
+              - s3:PutBucketTagging
+              - s3:GetBucketTagging
+            Effect: Allow
+            Resource:
+              - arn:aws:s3:::backgroundagent-dev-*
+              - arn:aws:s3:::backgroundagent-dev-*/*
+            Sid: S3ApplicationBuckets
           - Action:
               - kms:CreateGrant
               - kms:Decrypt
@@ -1304,13 +1357,13 @@ Outputs:
       Fn::Sub: ${ContainerAssetsRepository}
   BootstrapVersion:
     Description: The version of the bootstrap resources that are currently mastered in this stack
-    Value: '30'
+    Value: '32'
   BootstrapPolicyVersion:
     Description: The version of the ABCA bootstrap policy bundle
-    Value: 1.1.0
+    Value: 1.2.0
   BootstrapPolicyHash:
     Description: SHA-256 hash of the ABCA bootstrap policy bundle for drift detection
-    Value: a24d14dde94c546fdf94c7839492e92f612ae91def4660aaacab48d8e8da3146
+    Value: b0501c8a57f20e4b5bf50d6fe8bbb934310adc4b64480228565d8392a19d1503
   BootstrapPolicySet:
     Description: Comma-separated list of active ABCA bootstrap policy names
     Value:

cdk/bootstrap/policies/application.json

@@ -52,15 +52,30 @@
         "lambda:GetProvisionedConcurrencyConfig",
         "lambda:GetRuntimeManagementConfig",
         "lambda:ListVersionsByFunction",
-        "lambda:InvokeFunction"
+        "lambda:InvokeFunction",
+        "lambda:PublishLayerVersion",
+        "lambda:DeleteLayerVersion",
+        "lambda:GetLayerVersion"
       ],
       "Effect": "Allow",
       "Resource": [
         "arn:aws:lambda:*:*:function:backgroundagent-dev-*",
-        "arn:aws:lambda:*:*:function:backgroundagent-dev-AWS*"
+        "arn:aws:lambda:*:*:function:backgroundagent-dev-AWS*",
+        "arn:aws:lambda:*:*:layer:*"
       ],
       "Sid": "Lambda"
     },
+    {
+      "Action": [
+        "lambda:CreateEventSourceMapping",
+        "lambda:DeleteEventSourceMapping",
+        "lambda:UpdateEventSourceMapping",
+        "lambda:GetEventSourceMapping"
+      ],
+      "Effect": "Allow",
+      "Resource": "*",
+      "Sid": "LambdaEventSourceMappings"
+    },
     {
       "Action": [
         "apigateway:POST",
@@ -137,6 +152,39 @@
       "Resource": "arn:aws:events:*:*:rule/backgroundagent-dev-*",
       "Sid": "EventBridge"
     },
+    {
+      "Action": [
+        "sqs:CreateQueue",
+        "sqs:DeleteQueue",
+        "sqs:GetQueueAttributes",
+        "sqs:SetQueueAttributes",
+        "sqs:TagQueue",
+        "sqs:UntagQueue",
+        "sqs:GetQueueUrl",
+        "sqs:ListQueueTags"
+      ],
+      "Effect": "Allow",
+      "Resource": "arn:aws:sqs:*:*:backgroundagent-dev-*",
+      "Sid": "SQS"
+    },
+    {
+      "Action": [
+        "cloudfront:CreateDistribution",
+        "cloudfront:UpdateDistribution",
+        "cloudfront:DeleteDistribution",
+        "cloudfront:GetDistribution",
+        "cloudfront:TagResource",
+        "cloudfront:UntagResource",
+        "cloudfront:ListTagsForResource",
+        "cloudfront:CreateOriginAccessControl",
+        "cloudfront:UpdateOriginAccessControl",
+        "cloudfront:DeleteOriginAccessControl",
+        "cloudfront:GetOriginAccessControl"
+      ],
+      "Effect": "Allow",
+      "Resource": "*",
+      "Sid": "CloudFront"
+    },
     {
       "Action": [
         "secretsmanager:CreateSecret",
@@ -154,7 +202,11 @@
       "Effect": "Allow",
       "Resource": [
         "arn:aws:secretsmanager:*:*:secret:backgroundagent-*",
-        "arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*"
+        "arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*",
+        "arn:aws:secretsmanager:*:*:secret:SlackIntegration*",
+        "arn:aws:secretsmanager:*:*:secret:LinearIntegration*",
+        "arn:aws:secretsmanager:*:*:secret:GitHubScreenshot*",
+        "arn:aws:secretsmanager:*:*:secret:bgagent/*"
       ],
       "Sid": "SecretsManager"
     },

cdk/bootstrap/policies/observability.json

@@ -80,6 +80,28 @@
       ],
       "Sid": "S3CDKAssets"
     },
+    {
+      "Action": [
+        "s3:CreateBucket",
+        "s3:DeleteBucket",
+        "s3:PutBucketPolicy",
+        "s3:DeleteBucketPolicy",
+        "s3:PutBucketPublicAccessBlock",
+        "s3:GetBucketPublicAccessBlock",
+        "s3:PutEncryptionConfiguration",
+        "s3:PutLifecycleConfiguration",
+        "s3:GetBucketLocation",
+        "s3:ListBucket",
+        "s3:PutBucketTagging",
+        "s3:GetBucketTagging"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:s3:::backgroundagent-dev-*",
+        "arn:aws:s3:::backgroundagent-dev-*/*"
+      ],
+      "Sid": "S3ApplicationBuckets"
+    },
     {
       "Action": [
         "kms:CreateGrant",