security: implement group 6 - IAM and access control enhancements

[rshade]

IAM & Access Control Enhancements

Reference: security-groups/group-6-iam-access-control.md

Tasks

1. Split single service account into per-function SAs (API, Console, Migration) with least-privilege permissions
2. Migrate from HMAC keys to Workload Identity — eliminate shared secrets
3. Conditional IAM bindings — resource-scoping conditions for fine-grained access
4. Kubernetes RBAC enhancement — namespace-specific roles with restricted secret access
5. Data residency controls — organization policies and location-based IAM conditions

Important Notes — Time-Based IAM Conditions

⚠️ Time-based IAM conditions (business-hours restrictions) will break automated deployments. Before applying:

• The API service account runs 24/7 — do NOT apply time restrictions
• Migration service accounts are triggered by CI/CD — time windows at IAM level will cause failures
• If time-limiting is desired, control timing at the CI/CD pipeline level, not IAM
• Use resource-scoping conditions instead of time conditions for automated service accounts
• Cross-project bindings should not have time restrictions since the API service runs continuously

Acceptance Criteria

• Separate service accounts for API, Console, and Migration
• Workload Identity functional for all services
• Conditional IAM bindings with resource-scoping
• Kubernetes RBAC roles deployed
• No time-based conditions on automated service accounts
• All services maintain full functionality