Drop the machine-type memory reads from the WIF roles [murmur:murmuration/record-actual-vm-shape-costs]

[maerlyn5]

compute.machineTypes.get and ec2:DescribeInstanceTypes were granted so murmuration could read a machine type's RAM at VM creation, to size GCE's suspend snapshot and AWS's hibernation swap volume. It no longer asks.

A machine type's memory is fixed the moment the shape is chosen, and CatalogMachineType.memory_gb already records it — so the cloud read was a second answer to a question that only had one, bought at the price of a permission on every customer's role. murmuration now takes the number from the catalog, and these two permissions revert to unused.

The boot-disk read stays: disk_size_gb may be left unset to mean "take the boot image's own size", so only the created disk knows the GiB the customer is charged for. Nothing here touches the permissions that serve it.

Pairs with prassoai/murmuration#6231, which removes the calls. Merge order does not matter — removing a permission nothing requests, and removing a request for a permission, are independently safe.

Created via Murmur

Note

Drop machine-type memory reads from WIF roles

The PR title indicates intent to remove machine-type memory reads from WIF roles. However, the actual diff contains only blank-line modifications with no functional code changes.

^{Macroscope summarized fdbb011.}

🐞

Summarization
• Workflow

[macroscopeapp-nonprod]

Approvability

Verdict: Approved at fdbb011

Macroscope's review found this PR approvable — The supplied base and head are identical: the intermediate permission grant is completely canceled by the final commit. Merging this PR produces no Terraform, IAM, or runtime change.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp-nonprod]

Superseded by #9, which is cut from `main` and contains only the removal.

Recording why this one read as a no-op, since the verdict was reasonable given what it saw: this branch carried the pre-squash version of #7's grant commit and then the removal, so diffed against its own base it added two permissions and took them away again. Against main it was not a no-op — main carries #7's grants today (3b5bb13), and closing this left them in place while murmuration stopped calling the APIs they were granted for.

#9 has the same net effect with a one-commit history that cannot be misread.

^{Posted by Murmur}