From a5e9f11e16a1ad95f2a9f8383e694a483a117ba7 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 21 Sep 2026 19:44:13 -0400
Subject: [PATCH] test(iam): keep leftover Lambda boundary after role deletion
 (PLAT-218)

---
 tests/infra/test_hcp_contract.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/infra/test_hcp_contract.py b/tests/infra/test_hcp_contract.py
index c6a2eaa..0ec1a48 100644
--- a/tests/infra/test_hcp_contract.py
+++ b/tests/infra/test_hcp_contract.py
@@ -142,6 +142,12 @@ def test_leftover_lambda_iam_roles_removed():
         assert 'data "aws_iam_policy_document" "lambda_assume"' not in body
 
 
+def test_lambda_boundary_policy_remains():
+    boundary = (TERRAFORM / "lambda_boundary.tf").read_text()
+    assert 'resource "aws_iam_policy" "lambda_boundary"' in boundary
+    assert "afterhours-shift-manager-lambda-boundary" in boundary
+
+
 def test_local_functions_still_lists_packaging_keys():
     for name in (
         "afterhours-shift-manager",