Hardening backlog from tf-lint's first trivy run (ECR immutability, CI-role least-privilege, SNS encryption) #180

Decision 2026-10-30: items 1 and 2 accepted and filed as sub-issues (#224, with its pipeline half lentago/shared-workflows#85; #225); work started in the bullpen. Item 3 deferred: the topic carries alarm JSON, not secrets; the free managed key cannot be used by CloudWatch alarms; a customer-managed key is a paid exception under the free-tier rule. The trivy:ignore:AVD-AWS-0095 stays and this issue remains its pointer. Revisit if the topic ever carries more than alarm payloads or a CMK is paid for by another need. (#172, the subscription itself, closed 2026-10-30.) Original text follows.

The new tf-lint gate (shared-workflows v1.2.0, adoption PR #178) flagged seven HIGHs on its first run. Four were resolved in that PR (one real fix — ALB drop_invalid_header_fields — plus justified inline ignores for internet-facing ALB and SSE-S3 on the ALB log bucket, which cannot use SSE-KMS). These three are substantive and deliberately NOT swept into a lint-adoption PR. Each has an inline trivy:ignore pointing here; resolving an item means fixing it or documenting a deliberate decline, then removing its ignore.

1. AVD-AWS-0031 — ECR tag mutability (modules/ecr)

IMMUTABLE prevents image-mutation injection, but the site-deploy pipeline pushes :latest on every deploy, which immutability forbids. Fixing properly means moving task definitions to digest references (or per-deploy tags only) and dropping :latest — a pipeline design change across shared-workflows' site-deploy.yml and all three site repos. Worth doing; SLSA attestation already verifies by digest, so the pieces exist.

2. AVD-AWS-0345 ×2 — s3:* in the GitHub Actions terraform role (modules/iam)

The CI plan/apply role's policy grants <service>:* across ~20 services by design — it has to manage all of them. Trivy singles out s3:*. Genuine least-privilege for a Terraform CI role is a real project (permission diffs per provider resource); a cheaper meaningful step is splitting read-only plan credentials from apply credentials. Decide the target posture before touching it.

3. AVD-AWS-0095 — SNS alerts topic unencrypted (modules/monitoring)

The obvious one-liner is a trap: the free AWS-managed aws/sns key does NOT allow CloudWatch alarms to publish (no service grant possible on managed keys) — alarms would silently stop reaching the topic. Doing this correctly requires a customer-managed key with a key policy granting cloudwatch.amazonaws.com, which is a paid resource (~$1/mo + requests) — a flagged exception under the free-tier rule. Decide: accept plaintext topic metadata for a lab alert stream (contents are alarm JSON, not secrets), or pay for the CMK. Adjacent: #172 (the subscription itself may reach nobody — fix that first or encryption is moot).