# Production Falco IAM

These files are reviewable policy documents for production Falco.
They are not ArgoCD resources and are not applied automatically.

## 3567 role

Create this role in account `380838443567`:

```text
arn:aws:iam::380838443567:role/falco-prod-sidekick-s3-write
```

Use `falco-prod-sidekick-trust-policy.json` as its trust policy and
`falco-prod-s3-write-policy.json` as its inline policy.

The trust policy allows only the `falco-falcosidekick` ServiceAccount in the
18 production EKS clusters listed in `falco-prod-sidekick-trust-policy.json`.
The inline policy allows only `s3:PutObject` under the `falco/*` prefix,
matching the existing staging role policy.

## Additional production roles

The remaining registered production EKS clusters are split across two roles
because the IAM role trust-policy quota is 8192 bytes:

```text
arn:aws:iam::380838443567:role/falco-prod-sidekick-s3-write-0
arn:aws:iam::380838443567:role/falco-prod-sidekick-s3-write-1
```

Use the matching `falco-prod-sidekick-trust-policy-{0,1}.json` and
`falco-prod-s3-write-policy-{0,1}.json` files. Cohort 0 contains 17 OIDC
providers and cohort 1 contains 13. Each trust statement is restricted to the
same Falcosidekick ServiceAccount, with exact `sub` and `aud` conditions.

`falco-prod-sidekick-trust-policy-1-additions.json` contains the two approved
additions for `prod-seed-apne2-prem` and `prod-seed-use1-byoc-jpg-test`. Merge
its statements into the live `falco-prod-sidekick-s3-write-1` trust policy
before deploying either Application. Cohort 0 is already near the IAM 8,192
byte trust-policy limit; cohort 1 has sufficient capacity for both additions.

`falco-prod-sidekick-trust-policy-1-apse1-ess.json` contains the additional
trust statement for `prod-seed-apse1-ess`. Merge the statement into the same
live cohort 1 role before deploying that Application.

The overlays identify the role and use an isolated prefix:
`falco/prod/<exact EKS cluster name>`.

## Bucket owner account

The bucket owner must retain the existing production statement from
`falco-prod-bucket-policy-statement.json` for
`tidbcloud-falco-security-logs`. Do not replace the existing bucket policy
with these statements. Add the two additional statements from
`falco-prod-bucket-policy-statement-{0,1}.json`. The bucket uses SSE-S3
(`AES256`), so no KMS permission is required for this S3 path.

## Non-production auto-deploy roles

`falco-nonprod-bucket-policy-statement.json` authorizes the per-region
`falco-dev-*` and `falco-staging-*` roles created in account `385595570414` by
auto-deploy. The rule is limited to the matching `falco/dev/*` and
`falco/staging/*` prefixes. Add this statement to the bucket policy in account
`398894451188` before enabling automatic dev or staging region deployment.