From 7fbff09f6607a6eee4a37ee043563e7e439f930b Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Wed, 2 Sep 2026 12:19:46 -0400 Subject: [PATCH] fix(iam): tighten plan-refresh and scoped boundary pin (PLAT-146) Plan-refresh copied lambda:* from apply, so a plan session could mutate afi functions. Drop the unsuffixed org-wide Lambda boundary so scoped apply cannot retarget exec roles onto that ceiling. --- terraform/hcp_iam.tf | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf index 365b127..040d56b 100644 --- a/terraform/hcp_iam.tf +++ b/terraform/hcp_iam.tf @@ -110,7 +110,6 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" { variable = "iam:PermissionsBoundary" values = [ "arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*", - "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary", "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor", ] } @@ -131,7 +130,6 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" { variable = "iam:PermissionsBoundary" values = [ "arn:aws:iam::${local.account_id}:policy/tf-managed/afi-*", - "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary", "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-afi-backup-monitor", ] } @@ -328,9 +326,10 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" { } statement { - sid = "RefreshLambda" - effect = "Allow" - actions = ["lambda:*"] + sid = "RefreshLambda" + effect = "Allow" + # Read-only refresh for plan. Mutate APIs stay on the apply role. + actions = ["lambda:Get*", "lambda:List*"] resources = [ "arn:aws:lambda:us-east-1:${local.account_id}:function:afi-*", "arn:aws:lambda:us-east-1:${local.account_id}:layer:afi-shared*",