Grant ec2:DescribeSnapshots to the murmur read-only role [murmur:murmuration/fix-image-storage-oversize-billing]

[chenruichou]

Companion to prassoai/murmuration#5106, which fixes a ~8× over-charge in baked-image storage billing.

murmur billed a tenant's baked images on their nominal disk size. Both clouds bill what they actually store. For an AMI that quantity lives on its EBS snapshots — DescribeImages reports only each block mapping's nominal volume size, and a snapshot stores only the blocks written to its source volume — so murmur now reads FullSnapshotSizeInBytes via DescribeSnapshots.

That takes ec2:DescribeSnapshots on the read-only role this module provisions. Without it, a customer-managed AWS placement's image listing fails with an error naming the missing permission (murmur fails loudly rather than billing a number nobody vouched for). Apply this before the murmuration change rolls out.

Read-only, unconditioned, alongside the existing ec2:Describe* grants — no new blast radius.

Created via Murmur

🤖 Generated with Claude Code

Note

Grant ec2:DescribeSnapshots to the murmur read-only IAM role

Adds ec2:DescribeSnapshots to the readonly_ec2 IAM policy in main.tf. This permission is needed to account for AMI storage billing, which is based on snapshot sizes rather than image metadata alone.

^{Macroscope summarized 7540a61.}

🐞

Summarization
• Workflow

[macroscopeapp-nonprod]

Approvability

Verdict: Needs human review

While the change is technically minimal (adding one read-only IAM permission), its stated purpose is to enable image-storage accounting/billing functionality. Changes that affect billing or metering logic warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}