Merge branch 'main' into fix/502-ecs-payload-s3-pointer

Author: isadeks

cdk/bootstrap/bootstrap-template.yaml

@@ -930,6 +930,7 @@ Resources:
               - route53resolver:UpdateFirewallDomains
               - route53resolver:AssociateFirewallRuleGroup
               - route53resolver:DisassociateFirewallRuleGroup
+              - route53resolver:UpdateFirewallRuleGroupAssociation
               - route53resolver:GetFirewallRuleGroupAssociation
               - route53resolver:ListFirewallRuleGroupAssociations
               - route53resolver:UpdateFirewallConfig
@@ -1191,6 +1192,7 @@ Resources:
               - cloudwatch:TagResource
               - cloudwatch:UntagResource
               - logs:CreateDelivery
+              - logs:UpdateDeliveryConfiguration
               - logs:DescribeDeliveries
               - logs:GetDelivery
               - logs:GetDeliveryDestination

cdk/bootstrap/policies/infrastructure.json

@@ -153,6 +153,7 @@
         "route53resolver:UpdateFirewallDomains",
         "route53resolver:AssociateFirewallRuleGroup",
         "route53resolver:DisassociateFirewallRuleGroup",
+        "route53resolver:UpdateFirewallRuleGroupAssociation",
         "route53resolver:GetFirewallRuleGroupAssociation",
         "route53resolver:ListFirewallRuleGroupAssociations",
         "route53resolver:UpdateFirewallConfig",

cdk/bootstrap/policies/observability.json

@@ -44,6 +44,7 @@
         "cloudwatch:TagResource",
         "cloudwatch:UntagResource",
         "logs:CreateDelivery",
+        "logs:UpdateDeliveryConfiguration",
         "logs:DescribeDeliveries",
         "logs:GetDelivery",
         "logs:GetDeliveryDestination",

cdk/src/bootstrap/policies/infrastructure.ts

@@ -190,6 +190,7 @@ export function infrastructurePolicy(): iam.PolicyDocument {
           'route53resolver:UpdateFirewallDomains',
           'route53resolver:AssociateFirewallRuleGroup',
           'route53resolver:DisassociateFirewallRuleGroup',
+          'route53resolver:UpdateFirewallRuleGroupAssociation',
           'route53resolver:GetFirewallRuleGroupAssociation',
           'route53resolver:ListFirewallRuleGroupAssociations',
           'route53resolver:UpdateFirewallConfig',

cdk/src/bootstrap/policies/observability.ts

@@ -79,6 +79,7 @@ export function observabilityPolicy(): iam.PolicyDocument {
           'cloudwatch:TagResource',
           'cloudwatch:UntagResource',
           'logs:CreateDelivery',
+          'logs:UpdateDeliveryConfiguration',
           'logs:DescribeDeliveries',
           'logs:GetDelivery',
           'logs:GetDeliveryDestination',

cdk/test/handlers/shared/context-hydration.test.ts

@@ -75,6 +75,15 @@ global.fetch = mockFetch as unknown as typeof fetch;
 beforeEach(() => {
   jest.clearAllMocks();
   clearTokenCache();
+  // hydrateContext falls back to process.env.MEMORY_ID when no memoryId option
+  // is passed (context-hydration.ts:990). If MEMORY_ID leaks into the jest
+  // process env (set by another test file, or the deploy env when the suite
+  // runs in-container), the "memoryId not provided" tests would spuriously call
+  // loadMemoryContext and fail — an order/environment-dependent flake that
+  // forced the fork's build-gate to be bypassed with `git push --no-verify`.
+  // Pin a clean "no ambient memory" baseline; tests that want memory pass the
+  // memoryId option explicitly.
+  delete process.env.MEMORY_ID;
 });
 
 // ---------------------------------------------------------------------------

docs/design/DEPLOYMENT_ROLES.md

@@ -238,6 +238,7 @@ CloudFormation stack operations, IAM roles/policies, VPC networking, and Route 5
         "route53resolver:UpdateFirewallDomains",
         "route53resolver:AssociateFirewallRuleGroup",
         "route53resolver:DisassociateFirewallRuleGroup",
+        "route53resolver:UpdateFirewallRuleGroupAssociation",
         "route53resolver:GetFirewallRuleGroupAssociation",
         "route53resolver:ListFirewallRuleGroupAssociations",
         "route53resolver:UpdateFirewallConfig",
@@ -557,6 +558,7 @@ Bedrock Guardrails, CloudWatch Logs/Dashboards/Alarms, X-Ray, S3 (CDK assets), K
         "cloudwatch:TagResource",
         "cloudwatch:UntagResource",
         "logs:CreateDelivery",
+        "logs:UpdateDeliveryConfiguration",
         "logs:DescribeDeliveries",
         "logs:GetDelivery",
         "logs:GetDeliveryDestination",

docs/src/content/docs/architecture/Deployment-roles.md

@@ -242,6 +242,7 @@ CloudFormation stack operations, IAM roles/policies, VPC networking, and Route 5
         "route53resolver:UpdateFirewallDomains",
         "route53resolver:AssociateFirewallRuleGroup",
         "route53resolver:DisassociateFirewallRuleGroup",
+        "route53resolver:UpdateFirewallRuleGroupAssociation",
         "route53resolver:GetFirewallRuleGroupAssociation",
         "route53resolver:ListFirewallRuleGroupAssociations",
         "route53resolver:UpdateFirewallConfig",
@@ -561,6 +562,7 @@ Bedrock Guardrails, CloudWatch Logs/Dashboards/Alarms, X-Ray, S3 (CDK assets), K
         "cloudwatch:TagResource",
         "cloudwatch:UntagResource",
         "logs:CreateDelivery",
+        "logs:UpdateDeliveryConfiguration",
         "logs:DescribeDeliveries",
         "logs:GetDelivery",
         "logs:GetDeliveryDestination",