run_d6d83261a847d887

input

{
  "request": "Triage Jira ticket SREIN-1613: Grant iap.httpsResourceAccessor for den (dev now, prod next)",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/SREIN-1613"
  ],
  "sourceContext": {
    "issue": "SREIN-1613"
  }
}

summary

SREIN-1613 is a request to grant `roles/iap.httpsResourceAccessor` on GCP project `moz-fx-den-nonprod` (dev) now, and on `moz-fx-den-prod` later, so that GCP IAP can front the "den" (Firefox Program Dashboard) service for all Mozilla staff. This is a follow-up to the Security RRA's #1 HIGH recommendation (put public den endpoints behind IAP, with Auth0 SSO retained as a second, app-level authorization layer via the existing `den_*-access` group). The requester (abennet@mozilla.com, den tenant owner) has confirmed: IAP is already enabled at the app layer, the IAP OAuth client secret is already populated in GSM (`dev-gke-iap-secret-secrets` in `moz-fx-den-nonprod`, using the shared org-wide IAP client), and the only missing piece is the IAM binding itself, which the requester cannot self-serve (no `setIamPolicy` permission). A companion PR (mozilla/webservices-infra#11894) is ready to merge once the dev grant is in place. The ticket is currently sitting in Backlog with only an automated "reduced support / work-week" notice as a comment — no CloudEng engineer has triaged or actioned it yet.

findings

• Request is well-scoped and low-risk for dev: grant roles/iap.httpsResourceAccessor on moz-fx-den-nonprod to the all-staff/Mozilla-employees group, mirroring the org's standard IAP pattern (edge authentication for all staff, app-level group still restricts actual access).
• Prerequisite work is already done on the requester's side; the grant is the sole blocker to merging a ready PR and unblocking the RRA-recommended remediation.
• Prod grant is explicitly a follow-on, not needed immediately — should be tracked/executed only once dev is verified and IAP is mirrored to prod.
• Ticket has not been triaged by a human; the only comment is an automated CloudEng reduced-support notice, and the ticket remains in Backlog status.
• Related context tickets (SREIN-1590 for public exposure, IAM-2014 for SSO) are referenced but could not be independently verified in this triage pass due to access restrictions on those issue keys.

proposed actions

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "SREIN-1613"
    },
    "result": {
      "key": "SREIN-1613",
      "summary": "Grant iap.httpsResourceAccessor for den (dev now, prod next)",
      "status": "Backlog",
      "description_text": "Request:  Grant  roles/iap.httpsResourceAccessor  to the appropriate all-staff group so IAP-protected den endpoints allow Mozilla staff. Context:  We're putting den (Firefox Program Dashboard) behind GCP IAP, which is the #1 HIGH recommendation in the Security RRA for den (public endpoint, keep app-level Auth0 SSO as the second layer). Enabling IAP at the app layer is done, we just need the access binding. Status: Dev IAP chart change is ready to merge: mozilla/webservices-infra#11894 (host  options.iap  + externalSecrets). IAP OAuth client secret is populated in GSM  dev-gke-iap-secret-secrets  ( moz-fx-den-nonprod ), using the shared org-wide IAP client (id  873260360092-... ). Verified there is no  iap.httpsResourceAccessor  binding on  moz-fx-den-nonprod  yet, and I don't have  setIamPolicy  to add it myself. Ask: Grant  roles/iap.httpsResourceAccessor  to the right all-staff / Mozilla-employees group on  moz-fx-den-nonprod  (dev). Per the RRA, IAP is the \"authenticate staff at the edge\" layer; the curated  den_*-access  group stays as the app-layer restriction, so gating IAP to all staff is fine. Same grant on  moz-fx-den-prod  when we mirror IAP to prod. Once dev is granted, I'll merge #11894 and verify. Refs:  RRA (Den), SREIN-1590 (public exposure), IAM-2014 (SSO). Requested by abennet@mozilla.com (den tenant owner).",
      "comment_count": 1,
      "comments": [
        {
          "author": "Automation for Jira",
          "body": "Reduced Support for CloudEng work week: Expect delays for customer support requests. Non-urgent requests may get pushed off until after July 24th, 2026. If this is an incident, please follow the Incident Process.  https://mozilla-hub.atlassian.net/wiki/spaces/MIR/overview?homepageId=20512772 If this is a security incident, please follow the Security Incident Response process.  https://mozilla-hub.atlassian.net/wiki/spaces/SECURITY/pages/27165574/Security+Incident+Response If your request can't wait until after July 24th, please let us know when you need it by and why in a comment in this Jira issue."
        }
      ]
    }
  },
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "SREIN-1590"
    },
    "result": {
      "error": "read blocked by policy: resource not in run subject",
      "args": {
        "key": "SREIN-1590"
      }
    },
    "blocked": true
  },
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "IAM-2014"
    },
    "result": {
      "error": "read blocked by policy: resource not in run subject",
      "args": {
        "key": "IAM-2014"
      }
    },
    "blocked": true
  }
]

log