Repair DataOps OIDC SES configuration-set tag-on-create permission

[alexeygrigorev]

Extend the DataOps OIDC deploy role for reviewed sponsor communications

Status: in progress — PM accepted exact source; awaiting commit/integration and HUMAN apply
Tags: bug, infra, testing, P1
Depends on: None — implementation may run alongside #114; acceptance must recompare the final agent-approved #114 SAM resource graph
Blocks: #128 default-off deployment/HUMAN rollout; #134 On-Call closure after its application checks passed
Current evidence: run 30591398299 passed the complete app check job, then CloudFormation was denied ses:TagResource on the exact dataops-sponsor-reviewed-send-disabled configuration-set ARN and entered rollback.

Scope

Repair only the newly proven CloudFormation tag-on-create gap in the existing SponsorCommunicationsServiceDeployPolicy in DataTalksClub/aws-infra. The denied resource is exactly:

arn:${AWS::Partition}:ses:${FullDocsRegion}:${AWS::AccountId}:configuration-set/${SponsorSesConfigurationSetName}

The observed deployed name is dataops-sponsor-reviewed-send-disabled. Add no SES sending or runtime capability and no wildcard SES resource. Preserve the already effective Gate A/Gate B policies, OIDC trust, attachments, and unrelated dirty ../aws-infra checkout. Implementation must use a fresh isolated worktree from current aws-infra/origin/main (currently ddbaf2893bf2985d32e5a33310fe57e2f4ac9452; fetch and recheck before work).

Acceptance Criteria

• A fresh isolated aws-infra worktree starts from current origin/main; the dirty sibling checkout is untouched, and the candidate changes only sandbox/dataops/template.github-actions.yaml plus its focused policy test unless a narrowly justified public-safe fixture is required.
• The existing SponsorCommunicationsServiceDeployPolicy adds only ses:TagResource for the exact parameterized configuration-set ARN above. No Sponsor permission moves to the inline policy, no new managed policy/attachment is created, and Gate A/Gate B trust and documents remain otherwise unchanged.
• The implementation proves SES/CloudFormation tag-condition semantics. If aws:TagKeys safely applies, require a present key set limited by ForAllValues:StringEquals to exactly aws:cloudformation:logical-id, aws:cloudformation:stack-id, and aws:cloudformation:stack-name. If that condition would reject legitimate CloudFormation system tagging or is unsupported, record authoritative evidence and use only the exact-action/exact-ARN fallback—never a broader resource/action.
• The deploy role gains no ses:UntagResource, ses:*, wildcard SES ARN, send/bulk/raw-send, identity, template, contact-list, suppression-list, account, or runtime permission. Existing SES lifecycle actions remain exact.
• Parsed structural and negative-mutation tests prove the chosen tag statement/action/resource/condition, reject every prohibited broadening, preserve OIDC trust and all prior Gate A/Gate B capabilities, and keep policy-size plus attachment headroom. SAM lint, all sandbox/dataops tests, and git diff --check pass.
• The handoff records the exact base, changed-path inventory, binary diff hash, source-template hash, focused-test hash, and resolved compact Sponsor service-policy hash/size; an independent IAM/security reviewer accepts that exact fingerprint.
• The accepted aws-infra patch is committed/integrated to current main with Refs DataTalksClub/dataops#129 and no closing keyword; source integration alone does not authorize or perform AWS/application deployment.
• [HUMAN/AWS] After run 30591398299 reaches a terminal rollback state, a credentialed operator creates and independently reviews a dataops-github-actions CloudFormation change set with CAPABILITY_NAMED_IAM. It must show only the expected in-place Sponsor service managed-policy document update, with no deploy-role replacement, trust/attachment change, or unrelated resource change; apply it sequentially, require terminal UPDATE_COMPLETE, and verify the effective resolved document/fingerprint and stack drift without manual IAM edits.
• [HUMAN] Rerun the normal DataOps main GitHub Actions deployment with Sponsor sending disabled. The full application checks must remain green and CloudFormation must pass configuration-set tagging plus the default-off Roll out and cut over the Telegram conversational MVP #128/Use one Berlin business date in #106 scheduling and default-SPA E2E #134 deployment path. Use normal CI only—no manual app/Lambda deploy—and record sanitized On-Call evidence before closing Repair DataOps OIDC SES configuration-set tag-on-create permission #129.

Verification

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
uv run --with pytest python -m pytest sandbox/dataops/tests -q
git diff --check

Also resolve and compact-serialize the Sponsor service policy under deterministic pseudo/default values, compare it to the effective Gate A baseline, and run mutations for wildcard resource/action, SES send families, UntagResource, extra tag keys, missing/non-limiting tag-key conditions when the condition path is used, inline-policy relocation, trust/attachment drift, and policy quota regression.

Out of Scope for this follow-up

SES sending, identities, templates, runtime Lambda permissions, Sponsor content/secrets, application SAM/runtime changes, manual IAM/app deployment, speculative tagging actions, and the separate #128 HUMAN canaries. #134 application calendar checks are already green in the triggering run and are not modified here.

Historical original scope and rationale

The detailed original #129 design below records the already integrated/effective Gate A work. It is context, not authorization to broaden this exact tag-on-create repair.

Update the shared DataTalksClub/aws-infra source-of-truth template at:

sandbox/dataops/template.github-actions.yaml

so the existing dataops-github-actions-deploy OIDC role can let CloudFormation create/update/roll back the exact reviewed sponsor-communication resources declared by #114. Change no DataOps runtime code and apply no AWS stack during agent implementation/review.

The implementation must start in an isolated aws-infra worktree/branch from the latest origin/main, not the current dirty sibling checkout. At grooming time, origin/main is cc96704 and includes merged PR #18 / commit 691666a; the engineer must fetch again and use the then-current remote head. Suggested ownership:

worktree: /home/alexey/git/.worktrees/aws-infra-129
branch: issue-129-sponsor-communications-deploy-role

Do not stash, reset, overwrite, or merge the dirty ../aws-infra checkout. Preserve unrelated Datamailer/bookkeeping/auth work. The final source change belongs in DataTalksClub/aws-infra, not copied into dataops.

Authoritative resource graph

The current #114 generated SAM handoff declares these deployment resources:

• AWS::Serverless::Function logical IDs:
  • SponsorSendWorkerFunction
  • SponsorSesEventFunction
  • SponsorPrivateArchiveFunction
• generated Lambda execution roles:
  • SponsorSendWorkerFunctionRole
  • SponsorSesEventFunctionRole
  • SponsorPrivateArchiveFunctionRole
• corresponding /aws/lambda/<physical-function-name> log groups;
• one DynamoDB Stream event-source mapping for SponsorSendWorkerFunction;
• one Lambda EventInvokeConfig for SponsorSesEventFunction;
• SponsorCommunicationFailureQueue, retained and encrypted with alias/aws/sqs;
• SponsorSesConfigurationSet and SponsorSesEventDestination;
• stack-scoped scheduled/EventBridge rules, including SponsorSesEventRule;
• SponsorCommunicationPrivateArchiveBucket, retained/versioned/private/KMS-encrypted with ownership controls;
• SponsorCommunicationPrivateArchiveKey, retained with rotation.

Before Tester/PM acceptance, compare the proposed policy to the final accepted #114 infra/template.full.yaml and a fresh sam build/generated resource inventory. Remove permissions for resources that #114 drops; add nothing for speculative resources. If a final #114 logical ID changes, update exact patterns/tests before merge.

Preserve #124 / PR #18

PR #18 is already merged into aws-infra/origin/main but has not yet been applied to AWS. Preserve all of its effective permissions and tests:

• ConversationalExecutionWorkerFunction function/role/log patterns;
• ConversationalExecutionFailureQueue exact queue lifecycle;
• worker-conditioned Lambda event-source mapping create/read/update/delete;
• mapping tag lifecycle;
• existing stack-scoped EventBridge recovery-rule permissions.

#124 is not an implementation dependency for #129. A credentialed operator may apply PR #18 before #129 finishes. If the operator waits, the later #129 stack update must include and verify PR #18 as part of the same effective role update. #129 must not regress or silently relocate those permissions without an explicit equivalent-policy test.

Policy-size design

Do not append sponsor permissions to the existing inline role policy.

At grooming time, resolving origin/main with default parameters/account/region and compact-serializing dataops-v1-deploy produces approximately 9,341 non-whitespace characters, only 899 below IAM’s aggregate 10,240-character inline-policy quota for a role. Splitting into more inline policies would not help because the quota is aggregate across a role’s inline policies.

Add two stack-owned customer-managed policies attached only to GitHubActionsDeployRole:

1. SponsorCommunicationsComputeDeployPolicy — Lambda functions/roles/logs, Sponsor worker event-source mapping, Sponsor SES-event async invoke config, and failure queue lifecycle.
2. SponsorCommunicationsServiceDeployPolicy — exact SES configuration set/event-destination lifecycle and only the proven S3 ownership-control gap.

Use generated physical names for the managed policies (no globally fixed ManagedPolicyName). The credentialed operator, not the OIDC role, manages this dataops-github-actions infrastructure stack.

Add deterministic policy-size tests which resolve default parameters/pseudo-values and compact JSON:

• existing aggregate role inline policies remain at or below 9,472 non-whitespace characters, leaving at least 768 characters below 10,240;
• each new customer-managed policy remains at or below 5,120 non-whitespace characters, leaving at least 1,024 below the 6,144-character managed-policy limit;
• total attached customer-managed-policy count remains below the role quota with explicit headroom;
• sponsor additions appear only in the two new managed policies, not the nearly-full inline policy.

A source-text line count is not sufficient; tests must serialize the actual policy documents with deterministic substitutions. If current upstream changes already violate these headroom thresholds, stop and redesign/split rather than weakening the assertions.

AWS quota reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html

Exact compute deployment permissions

Lambda functions

Grant only the CloudFormation lifecycle/read/tag/permission actions needed for the three generated functions. Reuse the proven action set from LambdaDataOpsFunction, excluding Function URL operations because none of these functions has a Function URL, and excluding invoke unless a generated/deploy verification step demonstrably requires it.

Resource patterns must include unqualified and qualified forms for exactly:

arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-SponsorSendWorkerFunction-*
arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-SponsorSendWorkerFunction-*:* 
arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-SponsorSesEventFunction-*
arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-SponsorSesEventFunction-*:* 
arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-SponsorPrivateArchiveFunction-*
arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-SponsorPrivateArchiveFunction-*:* 

Whitespace above is illustrative only; tests must assert exact ARN strings without trailing spaces. Do not add ${FullDocsStackName}-Sponsor*, ${FullDocsStackName}-*, or account-wide Lambda resources.

Generated execution roles and PassRole

Grant the existing proven IAM role lifecycle plus iam:PassRole only on:

arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${FullDocsStackName}-SponsorSendWorkerFunctionRole-*
arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${FullDocsStackName}-SponsorSesEventFunctionRole-*
arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${FullDocsStackName}-SponsorPrivateArchiveFunctionRole-*

Do not grant iam:*, wildcard-role PassRole, user/group/policy-version administration, or PassRole for unrelated services/roles. The managed policies themselves are created/attached only when a credentialed operator applies the shared infra stack; the OIDC role does not receive permission to manage its own policy attachments.

Log groups

Grant the same proven log-group infrastructure lifecycle actions as existing functions for exactly both ARN forms of:

/aws/lambda/${FullDocsStackName}-SponsorSendWorkerFunction-*
/aws/lambda/${FullDocsStackName}-SponsorSesEventFunction-*
/aws/lambda/${FullDocsStackName}-SponsorPrivateArchiveFunction-*

Include base log-group and :* forms. Do not grant log-event read/write, arbitrary log groups, or retention changes outside these patterns.

Sponsor worker event-source mapping

Add lambda:CreateEventSourceMapping on Resource: "*" only because create has no resource ARN, with the supported lambda:FunctionArn condition restricted to the exact SponsorSendWorkerFunction-* ARN. Add get/update/delete on region/account event-source-mapping ARNs with the same worker-function condition.

Preserve PR #18’s separate Conversational worker conditions. Do not combine them into a broad *WorkerFunction* pattern. Existing mapping tag actions are already scoped to region/account mapping ARNs and need no new action/resource unless final generated behavior proves otherwise.

Sponsor SES-event async invoke config

Grant exactly:

• lambda:GetFunctionEventInvokeConfig
• lambda:PutFunctionEventInvokeConfig
• lambda:UpdateFunctionEventInvokeConfig
• lambda:DeleteFunctionEventInvokeConfig

on the unqualified/qualified SponsorSesEventFunction-* function ARN patterns only. Do not grant these actions on Backend, worker, archive, conversational, or wildcard functions.

Failure queue lifecycle

Grant exactly the CloudFormation queue lifecycle used and already proven for #124:

• sqs:CreateQueue
• sqs:DeleteQueue
• sqs:GetQueueAttributes
• sqs:GetQueueUrl
• sqs:ListQueueTags
• sqs:SetQueueAttributes
• sqs:TagQueue
• sqs:UntagQueue

on only:

arn:${AWS::Partition}:sqs:${FullDocsRegion}:${AWS::AccountId}:${FullDocsStackName}-SponsorCommunicationFailureQueue-*

Do not grant SendMessage, receive/delete/purge messages, sqs:*, or other queues to the deploy role. Runtime SendMessage belongs only to the generated Lambda roles managed through their exact role policy.

The queue uses AWS-managed SQS encryption (alias/aws/sqs), so this queue adds no deploy-role KMS permission. Tests must preserve DeletionPolicy: Retain, UpdateReplacePolicy: Retain, encryption, retention period, and sanitized-payload expectations in #114; #129 does not alter queue runtime configuration.

Exact SES configuration lifecycle

Add a SponsorSesConfigurationSetName parameter to the shared deploy-role template with a safe default matching #114 and constraints consistent with the application parameter. Bind the policy to exactly:

arn:${AWS::Partition}:ses:${FullDocsRegion}:${AWS::AccountId}:configuration-set/${SponsorSesConfigurationSetName}

Grant only the actions required by the two generated CloudFormation resource types:

• ses:CreateConfigurationSet
• ses:DeleteConfigurationSet
• ses:GetConfigurationSet
• ses:PutConfigurationSetSendingOptions
• ses:CreateConfigurationSetEventDestination
• ses:DeleteConfigurationSetEventDestination
• ses:GetConfigurationSetEventDestinations
• ses:UpdateConfigurationSetEventDestination

Do not grant ses:SendEmail, SendBulkEmail, SendRawEmail, identity creation/verification, template/contact-list operations, account-level SES changes, suppression-list operations, or ses:*. Add tag actions only if the final generated resource demonstrably emits SES tags and tests name the exact need; the current #114 resources declare none.

Service-authorization/resource references:

• https://docs.aws.amazon.com/service-authorization/latest/reference/list_sesv2.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ses-configurationset.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ses-configurationseteventdestination.html

EventBridge boundaries

The existing inline EventBridgeDataOpsRules statement already grants the stack-scoped rule lifecycle on:

arn:${AWS::Partition}:events:${FullDocsRegion}:${AWS::AccountId}:rule/${FullDocsStackName}-*

This covers the generated recovery schedule and explicit SponsorSesEventRule. The Lambda function policy covers its exact AWS::Lambda::Permission; the SES event destination is covered through SES configuration-set actions.

Add no new EventBridge action, event bus write, archive/replay permission, wildcard rule resource, or rule DLQ permission unless a final generated-template diff proves a missing operation. Tests must assert the #114 rule physical-name family matches the existing resource boundary.

Proven KMS and S3 handling

KMS

The existing deploy policy already contains the KMS key lifecycle actions required by the same retained/rotating key shape used elsewhere. kms:CreateKey necessarily uses Resource: "*"; do not add a second KMS statement, crypto data-plane action, grant administration, alias, or broader action. Tests must prove #114’s archive key needs no action absent from the existing KMS set.

S3

The existing DataOpsExportArchiveBucket statement already covers generated ${FullDocsStackName}-* bucket create/delete, encryption, versioning, lifecycle, public-access-block, tagging, and location/list operations. The only generated Sponsor private-archive property not covered there is OwnershipControls.

Add only:

• s3:GetBucketOwnershipControls
• s3:PutBucketOwnershipControls

on the lowercase generated Sponsor archive bucket family:

arn:${AWS::Partition}:s3:::${FullDocsStackName}-*sponsorcommunicationprivatearchive*

Do not add object read/write/delete, bucket-policy actions, s3:*, arbitrary buckets, or KMS crypto actions to the deploy role. Runtime object/KMS access remains in the generated SponsorPrivateArchiveFunctionRole, not OIDC deployment policy.

If the final #114 SAM diff changes the bucket properties, prove each additional action from that exact resource before adding it.

Tests and independent review

Add/extend sandbox/dataops/tests/test_template_github_actions.py with parsed structural assertions, not only substring checks. Required automated evidence:

• every exact function/qualified-function, generated role, and log-group pattern above exists once and broad near-matches fail tests;
• function actions omit URL/bulk/unneeded invocation capabilities;
• event-source create’s sole wildcard is condition-bound to SponsorSendWorker; read/update/delete have region/account mapping resources and exact function condition;
• async invoke-config actions are exact and SponsorSesEvent-only;
• failure queue actions/resource are exact and exclude data-plane/purge/wildcards;
• SES actions and exact configuration-set ARN are exact; sending, identity, template, account, bulk/raw, and wildcard capabilities are rejected;
• no new EventBridge or KMS permissions are introduced;
• S3 addition is exactly ownership-controls on the Sponsor archive bucket family;
• existing PR Import DTC Operations content directory #18 Conversational worker/queue/mapping effective permissions remain present;
• inline and each managed-policy compact resolved sizes satisfy the headroom thresholds;
• the OIDC trust policy remains restricted to DataTalksClub/dataops, branch main, and aud=sts.amazonaws.com;
• only the deploy-role template and its focused test file change, unless a narrowly required public-safe README note is justified.

Run:

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
uv run --with pytest python -m pytest sandbox/dataops/tests -q
git diff --check

Also parse the YAML, render/measure policy documents with deterministic default substitutions, and compare policy resource patterns against a fresh final #114 SAM build/resource inventory.

A separate security-focused Tester or Architect who did not implement the patch must review:

• every action against the generated resource lifecycle;
• every wildcard and supported condition key;
• IAM inline/managed policy quotas and attachment count;
• preservation of PR Import DTC Operations content directory #18;
• absence of runtime send/object/secret access;
• clean isolated diff and test evidence.

No live AWS simulation/apply is an agent test. Any IAM policy simulation is a post-apply read-only human/on-call check.

Historical original acceptance record

• The change is based on latest aws-infra/origin/main in an isolated clean worktree/branch and preserves the dirty sibling checkout and merged PR Import DTC Operations content directory #18.
• Two generated-name customer-managed policies, attached only to GitHubActionsDeployRole, hold all Sponsor additions; the existing inline policy receives no Sponsor permissions and retains at least 768 compact non-whitespace characters of headroom below 10,240.
• Each new managed policy stays at least 1,024 compact non-whitespace characters below 6,144, and attachment-count tests preserve quota headroom.
• Lambda lifecycle patterns cover exactly the three Sponsor function logical-ID families, their generated execution roles/PassRole, and their log groups—qualified forms where required—with no broad Sponsor/function/role/log wildcard.
• Event-source mapping permissions cover only SponsorSendWorkerFunction through exact supported function conditions while PR Import DTC Operations content directory #18’s Conversational worker mapping behavior remains intact.
• EventInvokeConfig lifecycle covers only SponsorSesEventFunction; existing stack-scoped EventBridge permissions cover Sponsor rules with no new EventBridge grant.
• Failure queue lifecycle actions/resource are exact, exclude queue data-plane/purge access, and require no KMS addition because the queue uses alias/aws/sqs.
• SES configuration-set/event-destination lifecycle actions are exact and scoped to the configured configuration-set ARN; the deploy role has no SES send, identity, template, bulk/raw, contact-list, suppression-list, or account-wide permission.
• Existing KMS permissions are reused unchanged; the only S3 addition is Get/Put ownership controls on the generated Sponsor private-archive bucket family, with no object/bucket-policy/broad access.
• Parsed negative tests reject every prohibited broadening above, verify exact OIDC trust, compare to the final Automate reviewed sponsor communications from booking milestones #114 resource inventory, and pass SAM lint, all sandbox/dataops tests, and git diff --check.
• An independent security review confirms least privilege, policy-size/attachment headroom, PR Import DTC Operations content directory #18 preservation, and the isolated diff before source merge.
• The accepted patch is committed/pushed from the isolated branch and merged through a reviewed DataTalksClub/aws-infra PR into main; the commit/PR uses Refs DataTalksClub/dataops#129, not a closing keyword because human application remains.
• [HUMAN] A credentialed operator reviews the CloudFormation change set, applies dataops-github-actions with CAPABILITY_NAMED_IAM, and confirms terminal UPDATE_COMPLETE without exposing credentials or private configuration.
• [HUMAN] On-Call reruns the DataOps deployment with Sponsor sending disabled, verifies Add transactional approval and durable execution recovery #124 and Automate reviewed sponsor communications from booking milestones #114 resource creation/effective IAM/event mappings/queue/SES/archive/log boundaries and sanitized defaults, then records evidence before Repair DataOps OIDC SES configuration-set tag-on-create permission #129 closes.

Test Scenarios

Exact generated resources

Given the final #114 SAM template/build and latest PR #18-based deploy-role template
When policy tests enumerate generated function/role/log/mapping/queue/SES/EventBridge/S3/KMS resources
Then every required lifecycle action matches exactly and speculative/broad/runtime capabilities are absent

Policy size and attachment headroom

Given resolved default/pseudo parameter values
When inline and managed policy documents are compact JSON serialized
Then aggregate inline size is at most 9,472, each new managed policy is at most 5,120, attachment count has headroom, and adding Sponsor statements to inline fails the test

#124 regression protection

Given merged PR #18 and its exact Conversational worker/queue/mapping conditions
When #129 is applied to the source template
Then all effective #124 capabilities remain and no condition is broadened to arbitrary workers/functions

Negative least privilege

Given mutations that add ses:SendEmail, SQS data-plane/purge, S3 object access, KMS crypto/grants, arbitrary PassRole/functions/logs, EventBridge bus writes, or unconditioned event-source create
When focused policy tests run
Then each mutation fails

Clean source integration

Given the dirty sibling checkout and current remote main
When the engineer implements/rebases/reviews #129
Then only the isolated worktree contains the focused diff, final branch includes current origin/main/PR #18, and the shared dirty checkout is untouched

Credentialed apply and rollback

Given a reviewed merged aws-infra commit and the current deployed dataops-github-actions stack
When a credentialed operator previews/applies the change
Then it reaches UPDATE_COMPLETE; if it fails, CloudFormation reaches a terminal rollback state and the operator can reapply the recorded pre-#129 template without manual deletion or policy edits

On-Call deployment verification

Given the deploy-role stack is updated and Sponsor send remains false
When the DataOps main deployment is rerun
Then CloudFormation creates/updates #124 and accepted #114 resources, generated role/function/log/mapping/queue/config-set/archive boundaries match source, no email is sent, logs/failure payloads remain sanitized, and On-Call records exact workflow/stack evidence

Source merge and human operator sequence

After Software Engineer, independent security Tester, and PM acceptance:

1. Commit in the isolated aws-infra branch with Refs DataTalksClub/dataops#129; do not push from or merge into the dirty sibling checkout.

2. Push the isolated branch and open a focused DataTalksClub/aws-infra PR to current main, following PR Import DTC Operations content directory #18’s shared-infrastructure precedent.

3. Require the independent security review and green SAM lint/tests before merge.

4. Merge to aws-infra/main. Source merge alone does not change AWS and does not unblock deployment.

5. Add human to Repair DataOps OIDC SES configuration-set tag-on-create permission #129 and leave it open.

6. [HUMAN] Record the exact pre-Repair DataOps OIDC SES configuration-set tag-on-create permission #129 aws-infra/main commit/template, inspect the CloudFormation change set, then run from aws-infra/sandbox/dataops:

   aws cloudformation deploy \
     --stack-name dataops-github-actions \
     --template-file template.github-actions.yaml \
     --region eu-west-1 \
     --capabilities CAPABILITY_NAMED_IAM

7. Confirm UPDATE_COMPLETE and inspect the effective role’s inline/attached policy names and size boundaries. If apply fails, confirm terminal rollback; if a completed update must be reverted, deploy the recorded pre-Repair DataOps OIDC SES configuration-set tag-on-create permission #129 template with the same named-IAM capability. Do not manually delete roles/policies or DataOps application resources.

8. Rerun the current DataOps deployment first with SponsorCommunicationSendEnabled=false. No template/HMAC secret value or real sponsor address is part of this issue.

9. Relaunch On-Call. Verify actual function/role/log patterns, Sponsor worker mapping/recovery rule, SES-event async config, retained encrypted failure queue, exact SES configuration set/event destination, private archive bucket/key, default-off sending, effective deploy/runtime IAM, and redacted logs/failure inputs. Also verify Add transactional approval and durable execution recovery #124’s previously blocked worker/queue/mapping resources now deploy.

10. Close Repair DataOps OIDC SES configuration-set tag-on-create permission #129 only after operator apply and On-Call evidence pass. Automate reviewed sponsor communications from booking milestones #114’s separate private-secret configuration and controlled test-inbox send remain its own human gates.

Rollback

The supported rollback is CloudFormation, not manual IAM editing:

• before apply, keep the exact prior aws-infra/main template/commit and review the change set;
• a failed update must reach UPDATE_ROLLBACK_COMPLETE or another explained terminal state before retry;
• after a successful but unacceptable update, redeploy the prior template with CAPABILITY_NAMED_IAM, confirm the two Sponsor managed policies detach/delete and PR Import DTC Operations content directory #18 remains effective, then rerun read-only policy checks;
• do not roll back/remove PR Import DTC Operations content directory #18 while Add transactional approval and durable execution recovery #124 resources exist;
• do not delete the retained Sponsor failure queue/archive/key or alter the DataOps app stack from this infrastructure issue;
• Sponsor sending remains disabled throughout apply/rollback verification.

Dependencies and boundaries

• Automate reviewed sponsor communications from booking milestones #114 code review may continue in parallel. Repair DataOps OIDC SES configuration-set tag-on-create permission #129 acceptance must compare against Automate reviewed sponsor communications from booking milestones #114’s final agent-approved SAM graph; Automate reviewed sponsor communications from booking milestones #114 production deploy cannot pass until Repair DataOps OIDC SES configuration-set tag-on-create permission #129 source is merged and the shared stack is applied.
• Add transactional approval and durable execution recovery #124 is already implemented and PR Import DTC Operations content directory #18 is merged. It can be unblocked immediately by a credentialed apply of current aws-infra/main; Repair DataOps OIDC SES configuration-set tag-on-create permission #129 must preserve that fix, and a later combined apply may deliver both.
• Repair DataOps OIDC SES configuration-set tag-on-create permission #129 does not provision private template/HMAC secrets, verify an SES identity, enable Sponsor sending, send an email, restore data, or change DataOps runtime/SAM code.
• Do not add broad permissions “in case CloudFormation needs them.” A real denied action after the exact patch is routed back through a new evidence-backed issue/change, not preemptive wildcarding.

Out of Scope

• Applying AWS from an agent session, manually editing live IAM, deleting retained resources, or deploying the DataOps application outside GitHub Actions.
• Runtime Lambda permissions, message content, Sponsor CRM logic/UI, SES sending behavior, private secrets, identity verification, domain/DNS work, or controlled test delivery (Automate reviewed sponsor communications from booking milestones #114).
• Reworking unrelated OIDC role permissions, dirty Datamailer/bookkeeping/auth changes, other AWS stacks/repos, or the current public/private knowledge boundary.
• Moving all existing inline permissions to managed policies, redesigning the entire deploy role, creating a permission boundary, or adding speculative services/actions.
• Closing Automate reviewed sponsor communications from booking milestones #114 or Add transactional approval and durable execution recovery #124 solely because the aws-infra source patch merged; deployment and On-Call evidence remain required.

[alexeygrigorev]

PM GROOMED — READY FOR ISOLATED AWS-INFRA IMPLEMENTATION

Validated intake author (alexeygrigorev) and reviewed:

• Automate reviewed sponsor communications from booking milestones #114’s regroomed architecture, current Software Engineer handoff, Architect changes request, generated SAM resources, and deploy workflow;
• Add transactional approval and durable execution recovery #124’s deployment rollback and accepted deploy-role repair;
• merged DataTalksClub/aws-infra PR Import DTC Operations content directory #18 / commit 691666a;
• current aws-infra/origin/main (cc96704 at grooming time), the dirty/outdated sibling checkout, deploy-role source, and focused tests.

Key decisions now encoded in #129:

• Work only from a clean isolated worktree/branch based on latest aws-infra/origin/main; never touch/reset/stash the dirty sibling checkout.
• Preserve all PR Import DTC Operations content directory #18 effective permissions and test them explicitly.
• The current resolved inline role policy is already about 9,341 non-whitespace characters, leaving only 899 below IAM’s 10,240 aggregate role-inline limit. Sponsor additions therefore go into two attached customer-managed policies with explicit per-policy and attachment-count headroom; no Sponsor permission is appended inline.
• Exact patterns cover only SponsorSendWorkerFunction, SponsorSesEventFunction, SponsorPrivateArchiveFunction, their generated roles/PassRole/logs, the Sponsor worker mapping, SES-event EventInvokeConfig, and the retained Sponsor failure queue.
• SES lifecycle is limited to the exact configured configuration-set ARN and exact create/read/update/delete/send-options/event-destination actions. The OIDC deploy role receives no email sending, raw/bulk, identity, template, contact-list, suppression-list, or account-wide SES capability.
• Existing stack-scoped EventBridge permission already covers Automate reviewed sponsor communications from booking milestones #114 rules, so no EventBridge addition is allowed without new generated evidence.
• Existing KMS lifecycle is sufficient and stays unchanged. Existing S3 lifecycle is sufficient except exact Get/Put OwnershipControls on the generated Sponsor archive bucket family; no object access is added.
• Parsed negative tests, deterministic compact policy-size tests, SAM lint, all sandbox/dataops tests, clean diff, final Automate reviewed sponsor communications from booking milestones #114 resource comparison, and independent security review are mandatory.
• The accepted source must merge through a focused DataTalksClub/aws-infra PR using Refs DataTalksClub/dataops#129. Source merge does not apply AWS.
• A credentialed operator apply, safe CloudFormation rollback path, default-off DataOps redeploy, and On-Call verification are explicit [HUMAN] gates. Repair DataOps OIDC SES configuration-set tag-on-create permission #129 stays open with human until they pass.

Readiness/dependencies:

• No implementation dependency: Repair DataOps OIDC SES configuration-set tag-on-create permission #129 can proceed in parallel with Automate reviewed sponsor communications from booking milestones #114 fixes.
• Acceptance must recompare the final agent-approved Automate reviewed sponsor communications from booking milestones #114 SAM graph and remove any obsolete permission.
• Repair DataOps OIDC SES configuration-set tag-on-create permission #129 blocks Automate reviewed sponsor communications from booking milestones #114 production deployment, not Automate reviewed sponsor communications from booking milestones #114 code review.
• Add transactional approval and durable execution recovery #124 does not depend on Repair DataOps OIDC SES configuration-set tag-on-create permission #129 source; PR Import DTC Operations content directory #18 is already merged and can be applied now. If the operator waits, the Repair DataOps OIDC SES configuration-set tag-on-create permission #129 apply must preserve/deliver PR Import DTC Operations content directory #18 and On-Call must verify Add transactional approval and durable execution recovery #124 as well.

No local file, commit, push, PR, live policy, stack, or AWS resource was changed during grooming.

[alexeygrigorev]

Software Engineer handoff — isolated aws-infra implementation ready for security review

Implemented the groomed shared-infrastructure policy change in a fresh isolated worktree based on the current remote head. No DataOps source, dirty sibling checkout, existing worktree, live AWS resource, remote branch, or pull request was changed.

Branch and commit

• Repository: DataTalksClub/aws-infra
• Base: origin/main at cc96704adad864964287cd241e2924d2c6a28e1d (merged PR Import DTC Operations content directory #18)
• Worktree: /home/alexey/git/.worktrees/aws-infra-129
• Branch: issue-129-sponsor-communications-deploy-role
• Commit: 9b5b8884630cf0eb43113be9149c528b41ec03ab
• Commit trailer: Refs DataTalksClub/dataops#129
• Push/apply/PR: not performed

Only these public-safe shared-infrastructure files changed:

• sandbox/dataops/template.github-actions.yaml
• sandbox/dataops/tests/test_template_github_actions.py

Delivered policy boundary

• Added the constrained SponsorSesConfigurationSetName parameter with the Automate reviewed sponsor communications from booking milestones #114 default and pattern.
• Added exactly two generated-name AWS::IAM::ManagedPolicy resources, each attached only to GitHubActionsDeployRole; no Sponsor permission entered the nearly-full inline policy and the role cannot administer these attachments itself.
• Compute policy covers exactly:
  • the three Sponsor function families and qualified forms, with the proven non-URL/non-invoke Lambda lifecycle;
  • their three generated execution-role families and existing exact IAM lifecycle/PassRole set;
  • their six exact log-group ARN forms;
  • SponsorSendWorker-only event-source mapping create and CRUD, using the supported exact lambda:FunctionArn condition;
  • SponsorSesEvent-only FunctionEventInvokeConfig lifecycle;
  • the exact retained Sponsor failure-queue lifecycle, with no queue data-plane/purge action.
• Service policy covers exactly:
  • the eight groomed SES configuration-set/event-destination actions on the configured configuration-set ARN;
  • Get/Put S3 ownership controls on the lowercase generated Sponsor archive bucket family.
• Added no SES send/raw/bulk/identity/template/contact/suppression/account action; no object/bucket-policy, EventBridge, KMS, secret, Function URL, or Lambda invoke capability.
• Preserved and structurally tests all PR Import DTC Operations content directory #18 Conversational function/role/log/queue/mapping/tag boundaries and the existing stack-scoped EventBridge lifecycle.

Structural and adversarial tests

The focused test file parses CloudFormation YAML into a real object graph, asserts exact statements/resources/conditions/attachments/trust, resolves default parameters plus pseudo-values, compact-serializes actual policy documents, and mutation-tests prohibited broadening.

PASS:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
23 passed, 24 subtests passed

Negative cases reject:

• Lambda invoke/Function URL and broad Sponsor function resources;
• absent/broad worker mapping conditions;
• async config on any non-SES-event function;
• SQS send/receive/delete-message/purge/wildcard actions;
• SES send/raw/bulk/identity/template/contact-list/suppression/account/wildcard actions and wildcard resources;
• S3 object/bucket-policy/wildcard access;
• EventBridge, KMS, secret access;
• Sponsor inline permissions, extra/fixed managed-policy attachments, trust drift, and PR Import DTC Operations content directory #18 regressions.

Policy-size and attachment evidence

Deterministically resolved with template defaults, aws, eu-west-1, and account 817685572750, then compact JSON serialized:

• aggregate inline role policy: 9,341 / 9,472 test ceiling, leaving 899 below IAM 10,240;
• compute managed policy: 3,706 / 5,120 test ceiling, leaving 2,438 below IAM 6,144;
• service managed policy: 717 / 5,120 test ceiling, leaving 5,427 below IAM 6,144;
• attached customer-managed policies: 2, leaving 8 below the standard role quota of 10.

Template and #114 graph verification

PASS:

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
uv run --with pytest python -m pytest sandbox/dataops/tests -q
git diff --check

A fresh make sam-build in the isolated #114 DataOps worktree also passed. Parsed generated output confirms exactly:

• functions: SponsorSendWorkerFunction, SponsorSesEventFunction, SponsorPrivateArchiveFunction;
• one DynamoDB mapping on SponsorSendWorker and async invoke config only on SponsorSesEvent;
• retained/encrypted SponsorCommunicationFailureQueue using alias/aws/sqs, 14-day retention;
• exact SES configuration set/destination and explicit Sponsor SES EventBridge rule;
• retained Sponsor archive bucket with ownership controls and rotated retained KMS key;
• no additional Sponsor compute/service family requiring deploy permission.

The existing EventBridge and KMS statements already cover the generated graph and remain unchanged. The DataOps worktree's tracked status remained unchanged after the ignored SAM build output.

READY FOR INDEPENDENT SECURITY REVIEW. The reviewer should audit every wildcard/condition and action against #114, the size/attachment quota assertions, PR #18 preservation, and the isolated two-file diff. Source must not be pushed/applied until the review and acceptance gates complete; live apply remains a credentialed human step.

[alexeygrigorev]

TEST PASS — independent IAM/security review of aws-infra commit 9b5b8884630cf0eb43113be9149c528b41ec03ab

Reviewed the isolated two-file change against the complete groomed #129 contract, current #114 worktree and latest Architect comments, fresh #114 SAM build output, merged aws-infra PR #18 / commit 691666a, AWS authorization resource boundaries, and IAM quotas. No file was edited, committed, pushed, merged, or applied to AWS.

Current #114 resource graph

A fresh build from /home/alexey/git/dataops/.tmp/worktrees/issue-114 using an isolated build directory succeeded. Parsing the built template found exactly:

• SponsorSendWorkerFunction with one DynamoDB event and one Schedule event;
• SponsorSesEventFunction with EventInvokeConfig;
• SponsorPrivateArchiveFunction;
• SponsorCommunicationFailureQueue;
• SponsorSesConfigurationSet and SponsorSesEventDestination;
• SponsorSesEventRule and SponsorSesEventInvokePermission;
• SponsorCommunicationPrivateArchiveBucket and SponsorCommunicationPrivateArchiveKey;
• no additional Sponsor compute/service resource family needing OIDC deploy permission.

The latest #114 Architect changes request concerns runtime/UI/history/event/archive validation, not this resource graph. Because #114 is still uncommitted and not finally accepted, any later SAM logical-ID/property change must trigger the mandatory final recompare before #129 PM acceptance/source merge.

Effective policy review

• The two new resources are generated-name AWS::IAM::ManagedPolicy objects and attach through Roles only to GitHubActionsDeployRole. ManagedPolicyName is absent. No Sponsor permission was added to the nearly-full inline policy, and the OIDC role received no ability to create/update/delete/tag or attach its own managed policies.
• Sponsor Lambda lifecycle is exactly 11 non-URL, non-invoke actions on the three named function families and their qualified forms. Generated role lifecycle/PassRole is exactly the existing proven 14-action set on the three generated execution-role families. Log lifecycle is exactly the existing six-action set on the six named log ARN forms.
• CreateEventSourceMapping has the only new Resource *, required because create has no resource ARN, and uses the supported lambda:FunctionArn condition for SponsorSendWorkerFunction only. Get/update/delete use the region/account event-source-mapping ARN and the same exact condition. PR #18s separate Conversational mapping create/CRUD conditions and mapping tag lifecycle remain byte-exact; the existing region/account mapping tag statement also covers the generated Sponsor mapping without a new broad grant.
• FunctionEventInvokeConfig has exactly get/put/update/delete on SponsorSesEventFunction unqualified/qualified ARNs only.
• SponsorCommunicationFailureQueue has exactly create/delete/get attributes/get URL/list tags/set attributes/tag/untag on the named queue family. It has no SendMessage, receive/delete-message, purge, wildcard, or unrelated queue access. alias/aws/sqs introduces no deploy-role KMS addition.
• SES has exactly the eight configuration-set/event-destination lifecycle actions required by the two Automate reviewed sponsor communications from booking milestones #114 resource types, scoped to the configured configuration-set ARN. There is no send/raw/bulk, identity, template, contact-list, suppression-list, account, tag, or wildcard SES capability.
• The existing stack-rule EventBridge statement covers the Sponsor rule and generated schedule family, while exact Lambda AddPermission covers their Lambda permissions. No EventBridge action was added.
• Existing KMS key lifecycle already covers the retained rotating archive key and is unchanged; the Sponsor policies add no KMS crypto/grant/alias action. Existing stack bucket lifecycle covers the archive bucket, and the only Sponsor S3 addition is Get/PutBucketOwnershipControls on the lowercase generated Sponsor archive family. There is no object, bucket-policy, or arbitrary-bucket capability.
• PR #18s Conversational function/role/log/queue/mapping/tag/EventBridge boundaries remain effective and are guarded structurally by the tests.

Managed-policy apply, rollback, and quotas

CloudFormation management of these two new customer-managed policies belongs to the credentialed shared-stack operator, not to the OIDC application-deploy role. The operator identity/change set must cover CreatePolicy, policy read/list, CreatePolicyVersion/default-version handling, DeletePolicyVersion/DeletePolicy, AttachRolePolicy/DetachRolePolicy, and any tag read/write calls CloudFormation emits. This is correctly left outside the role being modified and remains a HUMAN apply check.

Generated names avoid fixed-name replacement collisions. Roles: !Ref GitHubActionsDeployRole establishes the attachment dependency; neither policy is retained, so stack rollback/removal can detach and delete it instead of leaving a named orphan. A replacement of both policies can temporarily consume four attachments. The source template normally attaches two, leaving eight slots under the standard quota of ten; the operator must still inspect live external attachments in the change set.

Independent compact resolved sizes:

• aggregate inline: 9,341 / 10,240, leaving 899; test ceiling 9,472;
• compute managed policy: 3,706 / 6,144, leaving 2,438; test ceiling 5,120;
• service managed policy: 717 / 6,144, leaving 5,427; test ceiling 5,120;
• source-managed attachments: 2 / 10, leaving 8 before any live external attachment check.

Commands and evidence

• PASS — uv run --with pytest python -m pytest sandbox/dataops/tests -q: 23/23 tests and 24/24 negative subtests.
• PASS — sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml.
• PASS — git diff --check cc96704..9b5b888.
• PASS — isolated diff contains only template.github-actions.yaml and its focused test file; 144 template additions, no template deletion.
• PASS — aws-infra worktree status clean; branch base and merge-base equal current origin/main cc96704, which contains PR Import DTC Operations content directory #18.
• PASS — fresh Automate reviewed sponsor communications from booking milestones #114 sam build --config-env full-sandbox --build-dir .tmp/sam-security-129; built all five application functions and emitted a valid built template.
• PASS — sam validate --lint on that fresh Automate reviewed sponsor communications from booking milestones #114 built template.
• PASS — git diff --check in the current Automate reviewed sponsor communications from booking milestones #114 worktree; ignored build output did not alter tracked status.

The first default-directory make sam-build attempt encountered a stale existing .aws-sam cleanup error. The isolated fresh build directory succeeded, so this was pre-existing local artifact contention rather than a source/template failure.

This source patch passes the independent least-privilege/security gate for the current #114 graph. Source review does not authorize AWS application. The credentialed CloudFormation change-set/apply, live attachment count, terminal UPDATE_COMPLETE/rollback behavior, default-off DataOps redeploy, and On-Call verification remain separate HUMAN gates, and #129 must remain open until those pass.

[alexeygrigorev]

PM ACCEPTED — SOURCE CHANGE APPROVED; HUMAN APPLY/ON-CALL GATES REMAIN

Accepted DataTalksClub/aws-infra commit 9b5b8884630cf0eb43113be9149c528b41ec03ab from the PM/operator perspective. #114's final Architect PASS confirms that its complete Sponsor SAM graph is unchanged from the graph independently reviewed for #129, so the conditional final-resource acceptance gate is satisfied.

Final graph and least-privilege fit

The accepted policy covers exactly the final #114 infrastructure families:

• SponsorSendWorkerFunction, SponsorSesEventFunction, and SponsorPrivateArchiveFunction, their exact generated roles/PassRole, qualified/unqualified function forms, and log groups;
• the SponsorSendWorker-only DynamoDB event-source mapping, with create's necessary Resource: "*" constrained by exact lambda:FunctionArn, and CRUD on mapping ARNs with the same condition;
• EventInvokeConfig lifecycle only for SponsorSesEventFunction;
• exact lifecycle for retained SponsorCommunicationFailureQueue, without queue data-plane or purge actions;
• exact SES configuration-set/event-destination lifecycle on ${SponsorSesConfigurationSetName};
• only Get/Put ownership controls on the generated Sponsor private-archive bucket family.

The final #114 graph still has exactly those three functions, one worker mapping and worker schedule, SES-event async config, retained/encrypted failure queue, retained archive bucket/KMS key, SES configuration set/destination, explicit EventBridge rule, and invoke permission. No additional Sponsor family or deploy capability appeared during the final architecture remediation.

No Sponsor permission enters the nearly-full inline policy. The two generated-name customer-managed policies attach only to GitHubActionsDeployRole; neither has ManagedPolicyName, and the OIDC role cannot administer its own managed policies.

No Lambda invoke/Function URL, broad Sponsor function/role/log, wildcard PassRole, SES sending/identity/template/contact/suppression/account action, SQS data plane, S3 object/bucket-policy access, new EventBridge grant, new KMS grant, secret/provider/runtime access, or speculative service capability is present.

Existing stack-scoped EventBridge permissions cover the worker schedule and explicit SES rule. Existing KMS lifecycle covers the retained rotating key. Exact Lambda Add/RemovePermission covers generated and explicit Lambda permissions.

#124 preservation

The source branch is a direct child of aws-infra/origin/main commit cc96704, which contains merged #124 PR #18 / commit 691666a. Parsed tests preserve its conversational execution worker function/role/log families, retained failure queue, function-conditioned mapping create/CRUD, mapping tags, and stack-scoped EventBridge boundary. The Sponsor mapping remains a separate exact condition and does not broaden or replace #124.

Policy sizes and attachment headroom

Independent resolved compact sizes:

• aggregate inline: 9,341 / 10,240, leaving 899 and passing the 9,472 test ceiling;
• Sponsor compute: 3,706 / 6,144, leaving 2,438;
• Sponsor service: 717 / 6,144, leaving 5,427;
• Repair DataOps OIDC SES configuration-set tag-on-create permission #129 source-managed attachments: 2 / standard 10, leaving 8.

The now-accepted #130 child adds one separate dispatcher policy, so the combined source chain will have 3 / 10 attachments, leaving 7 before live external attachments. The operator must inspect current live attachments and temporary replacement pressure before executing the change set.

Rollback and operator usability

Generated policy names avoid fixed-name collisions. Roles: [!Ref GitHubActionsDeployRole] creates the attachment dependency; neither policy is retained, so CloudFormation can detach/delete it on rollback rather than leave a named orphan. The credentialed operator—not the OIDC role—must have managed-policy create/version/read/delete/tag and role attach/detach capabilities.

The supported rollback is redeploying the exact prior accepted shared-infra template with CAPABILITY_NAMED_IAM, then confirming Sponsor policies detach/delete while #124 remains effective. It must not remove PR #18 while its application resources exist, manually edit live IAM, or delete retained Sponsor application resources.

PM verification

• PASS — clean isolated worktree and direct-child history cc96704 -> 9b5b888.
• PASS — commit trailer Refs DataTalksClub/dataops#129.
• PASS — exact two-file diff: shared deploy-role template and focused parsed tests only.
• PASS — uv run --with pytest python -m pytest sandbox/dataops/tests -q: 23/23 tests, 24/24 negative subtests.
• PASS — sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml.
• PASS — git diff --check cc96704..9b5b888.
• PASS — final Automate reviewed sponsor communications from booking milestones #114 Architect review and source inspection confirm unchanged resource names/properties relevant to this policy.

Integration and remaining gates

#129 is accepted for source integration. Integrate the accepted aws-infra commit chain using the repository's local merge/push process; do not open a PR under the current DataOps process. Preserve Refs DataTalksClub/dataops#129. Because #130 commit 2a1b95f is an accepted direct child, the integrator may now integrate the combined #129+#130 chain in order.

Source integration does not mutate AWS. Keep #129 open and add/retain human. A credentialed operator must review the CloudFormation change set, live attachment count, and operator capability, then apply dataops-github-actions with CAPABILITY_NAMED_IAM and require terminal UPDATE_COMPLETE or an explained rollback state. On-Call must inspect the effective role, deploy DataOps only through normal CI with Sponsor sending disabled, verify #124 and #114 resources/boundaries, and record sanitized evidence before #129 closes.

No file, commit, branch, push, merge, AWS resource, email/provider, private repository, or runtime state was changed during PM acceptance.

[alexeygrigorev]

Accepted source integrated to DataTalksClub/aws-infra main in order: 9b5b888 followed by #130 2a1b95f. No PR was used for this integration. The issue remains open/HUMAN: a credentialed operator must apply the dataops-github-actions stack with named-IAM capability, verify the change set and live managed-policy attachments, then run On-Call checks.