fix: align perms with build stage

Author: samrose

audit-specs/baselines/ami-build/files-postgres-config.yml

@@ -8,7 +8,7 @@ file:
     filetype: directory
     owner: postgres
     group: postgres
-    mode: '0755'
+    mode: '0775'
   /etc/postgresql/postgresql.conf:
     exists: true
     filetype: file
@@ -40,13 +40,8 @@ file:
     filetype: directory
     owner: postgres
     group: postgres
-    mode: '0755'
-  /etc/postgresql-custom/platform-defaults.conf:
-    exists: true
-    filetype: file
-    owner: postgres
-    group: postgres
-    mode: '0644'
+    mode: '0775'
+  # Note: platform-defaults.conf and pgsodium_root.key are created at deploy time
   /etc/postgresql-custom/custom-overrides.conf:
     exists: true
     filetype: file
@@ -77,20 +72,14 @@ file:
     owner: postgres
     group: postgres
     mode: '0664'
-  /etc/postgresql-custom/pgsodium_root.key:
-    exists: true
-    filetype: file
-    owner: postgres
-    group: postgres
-    mode: '0600'
 
   # Extension custom scripts directory
   /etc/postgresql-custom/extension-custom-scripts:
     exists: true
     filetype: directory
     owner: postgres
     group: postgres
-    mode: '0755'
+    mode: '0775'
   /etc/postgresql-custom/extension-custom-scripts/before-create.sql:
     exists: true
     filetype: file
@@ -104,10 +93,10 @@ file:
     filetype: directory
     owner: postgrest
     group: postgrest
-    mode: '0755'
+    mode: '0775'
   /etc/postgrest/base.conf:
     exists: true
     filetype: file
-    owner: root
-    group: root
-    mode: '0664'
+    owner: postgrest
+    group: postgrest
+    mode: '0644'

audit-specs/baselines/ami-build/files-postgres-data.yml

@@ -9,9 +9,11 @@ file:
     owner: postgres
     group: postgres
     mode: '0755'
+  # Note: /var/lib/postgresql/data is a symlink during AMI build (points to /data/...)
+  # The actual data directory is created at deploy time
   /var/lib/postgresql/data:
     exists: true
-    filetype: directory
-    owner: postgres
-    group: postgres
-    mode: '0700'
+    filetype: symlink
+    owner: root
+    group: root
+    mode: '0777'

audit-specs/baselines/ami-build/files-ssl.yml

@@ -19,19 +19,12 @@ file:
     exists: true
     filetype: directory
     owner: root
-    group: ssl-cert
-    mode: '0710'
+    group: postgres
+    mode: '0750'
   /etc/ssl/openssl.cnf:
     exists: true
     filetype: file
     owner: root
     group: root
     mode: '0644'
-
-  # AdminAPI SSL directory (created during AMI build)
-  /etc/ssl/adminapi:
-    exists: true
-    filetype: directory
-    owner: adminapi
-    group: root
-    mode: '0700'
+  # Note: /etc/ssl/adminapi is created at deploy time, not during AMI build