fix(bootstrap): grant missing Update* actions for DNS-firewall association + log delivery (#595)

* fix(bootstrap): grant route53resolver:UpdateFirewallRuleGroupAssociation to exec role

Live-caught deploying the ECS substrate to dev (--context compute_type=ecs): the
CFN execution role got AccessDenied on route53resolver:UpdateFirewallRuleGroup-
Association, failing DnsFirewall/RuleGroupAssociation and rolling back the stack.

The bootstrap policy already grants Associate/Disassociate/Get/List on the
firewall rule-group association but not Update. That action is only exercised
when CFN does an in-place UPDATE of the existing association (e.g. coming out of
a rollback, or any change that rewrites the resource) — a fresh create or a
no-op update never hits it, which is why it went unnoticed until now. Classic
least-privilege bootstrap drift (same class as #402/#404/#407/#409), NOT an ECS-
or branch-specific issue: main lacks the action too; deploying the ECS path just
exercised the update path that surfaces it.

Not added: the non-fatal s3:Get*/TagResource read-sweep denials CFN's S3 handler
emits — those are tolerated (no S3 resource failed), and granting describe-handler
breadth for unused bucket features would bury real gaps (the #406 lesson).

Regenerated bootstrap artifacts + updated the DEPLOYMENT_ROLES.md golden and its
Starlight mirror. Full cdk suite green (125 suites / 2289 tests).

(cherry picked from commit f69f01a)

* fix(bootstrap): grant logs:UpdateDeliveryConfiguration to exec role

Live-caught deploying to dev: the CFN execution role got AccessDenied on
logs:UpdateDeliveryConfiguration updating RuntimeApplicationLogsDelivery
(AWS::Logs::Delivery), which failed the stack update AND its rollback → the stack
landed in UPDATE_ROLLBACK_FAILED.

The observability bootstrap policy grants CreateDelivery + the LogDelivery family
(Create/Get/Update/DeleteLogDelivery) + Put/Get/Delete DeliverySource/Destination,
but not UpdateDeliveryConfiguration. That action is only exercised when CFN does an
IN-PLACE update of an existing AWS::Logs::Delivery resource — a fresh create never
hits it, so it went unnoticed until a stack that already had the delivery resource
was updated. Same least-privilege bootstrap-drift class as #402/#404/#407/#409 and
the route53resolver:UpdateFirewallRuleGroupAssociation fix on this branch.

NOT an ECS- or branch-specific gap: verified logs:UpdateDeliveryConfiguration is
absent on main and linear-vercel too, and this branch does not touch the delivery
resource or observability.ts — the ECS deploy-verify merely exercised the update
path that surfaces the latent hole.

Regenerated bootstrap artifacts + updated the DEPLOYMENT_ROLES.md golden and its
Starlight mirror. Full cdk suite green (125 suites / 2289 tests).

(cherry picked from commit 1697c38)

Author: isadeks

cdk/bootstrap/bootstrap-template.yaml

@@ -930,6 +930,7 @@ Resources:
               - route53resolver:UpdateFirewallDomains
               - route53resolver:AssociateFirewallRuleGroup
               - route53resolver:DisassociateFirewallRuleGroup
+              - route53resolver:UpdateFirewallRuleGroupAssociation
               - route53resolver:GetFirewallRuleGroupAssociation
               - route53resolver:ListFirewallRuleGroupAssociations
               - route53resolver:UpdateFirewallConfig
@@ -1191,6 +1192,7 @@ Resources:
               - cloudwatch:TagResource
               - cloudwatch:UntagResource
               - logs:CreateDelivery
+              - logs:UpdateDeliveryConfiguration
               - logs:DescribeDeliveries
               - logs:GetDelivery
               - logs:GetDeliveryDestination

cdk/bootstrap/policies/infrastructure.json

@@ -153,6 +153,7 @@
         "route53resolver:UpdateFirewallDomains",
         "route53resolver:AssociateFirewallRuleGroup",
         "route53resolver:DisassociateFirewallRuleGroup",
+        "route53resolver:UpdateFirewallRuleGroupAssociation",
         "route53resolver:GetFirewallRuleGroupAssociation",
         "route53resolver:ListFirewallRuleGroupAssociations",
         "route53resolver:UpdateFirewallConfig",

cdk/bootstrap/policies/observability.json

@@ -44,6 +44,7 @@
         "cloudwatch:TagResource",
         "cloudwatch:UntagResource",
         "logs:CreateDelivery",
+        "logs:UpdateDeliveryConfiguration",
         "logs:DescribeDeliveries",
         "logs:GetDelivery",
         "logs:GetDeliveryDestination",

cdk/src/bootstrap/policies/infrastructure.ts

@@ -190,6 +190,7 @@ export function infrastructurePolicy(): iam.PolicyDocument {
           'route53resolver:UpdateFirewallDomains',
           'route53resolver:AssociateFirewallRuleGroup',
           'route53resolver:DisassociateFirewallRuleGroup',
+          'route53resolver:UpdateFirewallRuleGroupAssociation',
           'route53resolver:GetFirewallRuleGroupAssociation',
           'route53resolver:ListFirewallRuleGroupAssociations',
           'route53resolver:UpdateFirewallConfig',

cdk/src/bootstrap/policies/observability.ts

@@ -79,6 +79,7 @@ export function observabilityPolicy(): iam.PolicyDocument {
           'cloudwatch:TagResource',
           'cloudwatch:UntagResource',
           'logs:CreateDelivery',
+          'logs:UpdateDeliveryConfiguration',
           'logs:DescribeDeliveries',
           'logs:GetDelivery',
           'logs:GetDeliveryDestination',

docs/design/DEPLOYMENT_ROLES.md

@@ -238,6 +238,7 @@ CloudFormation stack operations, IAM roles/policies, VPC networking, and Route 5
         "route53resolver:UpdateFirewallDomains",
         "route53resolver:AssociateFirewallRuleGroup",
         "route53resolver:DisassociateFirewallRuleGroup",
+        "route53resolver:UpdateFirewallRuleGroupAssociation",
         "route53resolver:GetFirewallRuleGroupAssociation",
         "route53resolver:ListFirewallRuleGroupAssociations",
         "route53resolver:UpdateFirewallConfig",
@@ -557,6 +558,7 @@ Bedrock Guardrails, CloudWatch Logs/Dashboards/Alarms, X-Ray, S3 (CDK assets), K
         "cloudwatch:TagResource",
         "cloudwatch:UntagResource",
         "logs:CreateDelivery",
+        "logs:UpdateDeliveryConfiguration",
         "logs:DescribeDeliveries",
         "logs:GetDelivery",
         "logs:GetDeliveryDestination",

docs/src/content/docs/architecture/Deployment-roles.md

@@ -242,6 +242,7 @@ CloudFormation stack operations, IAM roles/policies, VPC networking, and Route 5
         "route53resolver:UpdateFirewallDomains",
         "route53resolver:AssociateFirewallRuleGroup",
         "route53resolver:DisassociateFirewallRuleGroup",
+        "route53resolver:UpdateFirewallRuleGroupAssociation",
         "route53resolver:GetFirewallRuleGroupAssociation",
         "route53resolver:ListFirewallRuleGroupAssociations",
         "route53resolver:UpdateFirewallConfig",
@@ -561,6 +562,7 @@ Bedrock Guardrails, CloudWatch Logs/Dashboards/Alarms, X-Ray, S3 (CDK assets), K
         "cloudwatch:TagResource",
         "cloudwatch:UntagResource",
         "logs:CreateDelivery",
+        "logs:UpdateDeliveryConfiguration",
         "logs:DescribeDeliveries",
         "logs:GetDelivery",
         "logs:GetDeliveryDestination",