run_213889dffe2f0df2

input

{
  "request": "Triage Jira ticket MZCLD-3659: Clean up orphaned/split *.cdn.mozilla.net ACM certs (2 accounts) + re-consolidate E2QK4SHVJKQL10",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/MZCLD-3659"
  ],
  "sourceContext": {
    "issue": "MZCLD-3659"
  }
}

summary

MZCLD-3659 is a low-urgency ACM/CloudFront cleanup ticket surfaced from the MZCLD-3236 cert-runbook review (root cause of the June 2026 accounts-static.cdn.mozilla.net incident: in-place ACM re-import doesn't propagate to CloudFront edges). The ticket asks to re-consolidate distribution E2QK4SHVJKQL10 back onto the canonical *.cdn.mozilla.net wildcard cert and then delete 4 now-orphaned/expired ACM certs across two AWS accounts (cloudservices-prod, it-cdn). All certs remain valid through 2026-09-01/02, so there is no time pressure, but the work requires write access in both accounts, which is why the reporter (André Honeiser) is asking for it to be triaged to on-call/SRE rather than done by the requesting team. Recommend accepting into SRE triage backlog, assigning to on-call, and executing in the documented order (re-point distribution → verify → delete unused certs → verify dashboards) with a target date comfortably before the 2026-09-01/02 expirations.

findings

• Ticket is explicitly low urgency/ACM hygiene, not a certificate renewal — all affected certs are valid until 2026-09-01/02.
• Root cause of the underlying June 2026 accounts-static.cdn.mozilla.net incident is documented in the cdn renewal runbook: in-place ACM re-import does not propagate to CloudFront edges, which is why the split/orphaned certs exist.
• Cleanup spans two AWS accounts and requires write access to ACM and CloudFront (update-distribution + certificate deletion), which the requester's team does not have/does not want to perform themselves — hence the ask to route to SRE on-call.
• Concrete, well-scoped remediation plan is already provided in the ticket: (1) re-point distribution E2QK4SHVJKQL10 from cert 05cb0152 to canonical wildcard efb7a679 in cloudservices-prod (forces edge redeploy), (2) confirm success, (3) delete orphaned/expired certs 05cb0152, 73da46a5, 182b552a (cloudservices-prod) and 64be804d (it-cdn), (4) verify dashboards are clean.
• Attempted to pull additional context from the referenced MZCLD-3236 cert-runbook review ticket, but access was blocked by policy, so triage relies solely on the MZCLD-3659 description/comments for root-cause detail.

proposed actions

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3659"
    },
    "result": {
      "key": "MZCLD-3659",
      "summary": "Clean up orphaned/split *.cdn.mozilla.net ACM certs (2 accounts) + re-consolidate E2QK4SHVJKQL10",
      "status": "Backlog",
      "description_text": "Surfaced during the MZCLD-3236 certificate-runbook review. Cleanup of leftover ACM certs from the June 2026  accounts-static.cdn.mozilla.net  incident (root cause: in-place ACM re-import doesn't propagate to CloudFront edges \u2014 see the cdn renewal runbook). Current split state (verified 2026-08-04, read-only): Account  cloudservices-prod  (361527076523): efb7a679-\u2026  \u2014  *.cdn.mozilla.net , ISSUED (exp 2026-09-01),  13  distros \u2014 the canonical wildcard, keep. 05cb0152-\u2026  \u2014  *.cdn.mozilla.net , ISSUED (exp 2026-09-02),  1  distro ( E2QK4SHVJKQL10 ) \u2014 split-off from the incident. 73da46a5-\u2026  (us-west-2) \u2014  *.cdn.mozilla.net , ISSUED,  0 in use  \u2014 orphan. 182b552a-\u2026  \u2014  *.services.mozilla.com ,  EXPIRED 2026-06-07 , 0 in use \u2014 orphan. Account  it-cdn  (369987351092): 1cc728d0-\u2026  \u2014  *.cdn.mozilla.net , ISSUED (exp 2026-09-02), in use (videos/mozorg) \u2014 keep. 64be804d-\u2026  \u2014  *.cdn.mozilla.net ,  EXPIRED 2026-06-09 , 0 in use \u2014 orphan (March wildcard). Proposed cleanup (all writes; do during triage/on-call): Re-point  E2QK4SHVJKQL10  (accounts-static) from  05cb0152  back to the canonical wildcard  efb7a679  (same  *.cdn.mozilla.net  material) so all 14 distros are unified again. This  update-distribution  also forces the edge redeploy. After confirming, delete the now-unused certs:  05cb0152  +  73da46a5  (cloudservices-prod),  64be804d  (it-cdn), and the expired  182b552a  ( *.services , cloudservices-prod). Verify dashboards clean. Low urgency \u2014 everything valid until 2026-09-01/02; this is dashboard/ACM hygiene, not a renewal.",
      "comment_count": 1,
      "comments": [
        {
          "author": "Andr\u00e9 Honeiser",
          "body": "\u2014 this came out of the MZCLD-3236 cert-runbook review (root cause of the June accounts-static page is documented there). It's ACM/dashboard hygiene, not urgent \u2014 all certs are valid through 2026-09-01/02. Could you slot it into SRE triage and assign to whoever's on-call? The cleanup spans two AWS accounts (cloudservices-prod + it-cdn) and needs write access, so we're deliberately not doing it ourselves here."
        }
      ]
    }
  },
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3236"
    },
    "result": {
      "error": "read blocked by policy: resource not in run subject",
      "args": {
        "key": "MZCLD-3236"
      }
    },
    "blocked": true
  }
]

log