fix(infra): scope Vercel backend role trust to one project and production (#193)

Co-authored-by: Jarod Stewart <949393+stewartjarod@users.noreply.github.com>
Co-authored-by: polylane[bot] <277585245+polylane[bot]@users.noreply.github.com>

Author: polylane[bot]

cloudformation/vercel-oidc-role.yaml

@@ -13,10 +13,11 @@ Parameters:
     Description: "Your Vercel Team ID (found in Team Settings, e.g., 'team_xxxxx')"
     MinLength: 1
 
-  VercelProjectId:
+  VercelProjectName:
     Type: String
-    Description: "Your Vercel Project ID (found in Project Settings, e.g., 'prj_xxxxx')"
+    Description: "Your Vercel Project Name (from the project URL or Project Settings, e.g., 'wraps-web')"
     MinLength: 1
+    Default: "wraps-web"
 
 Resources:
   # OIDC Identity Provider for Vercel (Team Mode)
@@ -54,10 +55,10 @@ Resources:
                 # Audience uses team slug (not team ID)
                 "oidc.vercel.com/wraps:aud": !Sub "https://vercel.com/${VercelTeamSlug}"
               StringLike:
-                # Subject uses owner:teamSlug with wildcards for any project/environment
-                "oidc.vercel.com/wraps:sub":
-                  - !Sub "owner:${VercelTeamSlug}:project:*:environment:preview"
-                  - !Sub "owner:${VercelTeamSlug}:project:*:environment:production"
+                # Subject is owner:<team-slug>:project:<project-name>:environment:<environment>.
+                # Scope to this single project and to the production environment only:
+                # a preview deployment of any project in the team must not assume this role.
+                "oidc.vercel.com/wraps:sub": !Sub "owner:${VercelTeamSlug}:project:${VercelProjectName}:environment:production"
       ManagedPolicyArns:
         - !Ref VercelBackendPolicy
       Tags:

docs/VERCEL_OIDC_SETUP.md

@@ -14,37 +14,37 @@ Instead of storing long-lived AWS credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_
 ## Prerequisites
 
 - Wraps AWS account (905130073023)
-- Vercel Team ID and Project ID
+- Vercel Team slug and Project name
 - AWS CLI configured with Wraps account credentials
 
-## Step 1: Get Vercel IDs
+## Step 1: Get Vercel identifiers
 
 ### Get Team ID
 1. Go to https://vercel.com/account
 2. Click on your team settings
 3. Copy the Team ID (format: `team_xxxxx`)
 
-### Get Project ID
+### Get Project Name
 1. Go to your Vercel project settings
-2. Navigate to "General" tab
-3. Copy the Project ID (format: `prj_xxxxx`)
+2. Navigate to the "General" tab
+3. Copy the Project Name (for example, `wraps-web`)
 
 ## Step 2: Deploy CloudFormation Stack
 
 Deploy the OIDC provider and IAM role to your Wraps AWS account:
 
 ```bash
-# Set your Vercel IDs
+# Set your Vercel identifiers
 VERCEL_TEAM_ID="team_xxxxx"
-VERCEL_PROJECT_ID="prj_xxxxx"
+VERCEL_PROJECT_NAME="wraps-web"
 
 # Deploy the stack
 AWS_PROFILE=wraps aws cloudformation create-stack \
   --stack-name wraps-vercel-oidc \
   --template-body file://cloudformation/vercel-oidc-role.yaml \
   --parameters \
     ParameterKey=VercelTeamId,ParameterValue=${VERCEL_TEAM_ID} \
-    ParameterKey=VercelProjectId,ParameterValue=${VERCEL_PROJECT_ID} \
+    ParameterKey=VercelProjectName,ParameterValue=${VERCEL_PROJECT_NAME} \
   --capabilities CAPABILITY_NAMED_IAM \
   --region us-east-1
 
@@ -117,8 +117,8 @@ Call STS AssumeRoleWithWebIdentity
 Vercel OIDC Provider validates token
     ↓
 Check trust policy conditions:
-  - aud = "vercel"
-  - sub = "team:xxx:project:xxx:environment:production"
+  - aud = "https://vercel.com/<team-slug>"
+  - sub = "owner:<team-slug>:project:<project-name>:environment:production"
     ↓
 Return temporary credentials (valid ~1 hour)
     ↓
@@ -151,7 +151,7 @@ After deployment, check that OIDC is working:
 
 **Cause**: Trust policy doesn't match your Vercel team/project.
 
-**Fix**: Verify the Team ID and Project ID in the CloudFormation parameters:
+**Fix**: Verify the team slug and project name in the CloudFormation parameters:
 ```bash
 AWS_PROFILE=wraps aws cloudformation describe-stacks \
   --stack-name wraps-vercel-oidc \