fix(infra): split hcptf apply policy and omit empty queue ARNs (PLAT-216) (#261)

The combined services inline policy exceeded 10KB, and an empty
checkcomponents ARN made CreatePolicy reject the Lambda boundary in dev.

terraform/hcp_iam.tf

@@ -562,6 +562,9 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
     resources = ["*"]
   }
 
+}
+
+data "aws_iam_policy_document" "hcptf_apply_ecs" {
   statement {
     sid    = "EcsWorkload"
     effect = "Allow"
@@ -1083,6 +1086,12 @@ resource "aws_iam_role_policy" "hcptf_apply_services" {
   policy = data.aws_iam_policy_document.hcptf_apply_services.json
 }
 
+resource "aws_iam_role_policy" "hcptf_apply_ecs" {
+  name   = "afterhours-shift-manager-ecs"
+  role   = aws_iam_role.hcptf_apply.id
+  policy = data.aws_iam_policy_document.hcptf_apply_ecs.json
+}
+
 resource "aws_iam_role_policy" "hcptf_plan_refresh" {
   name   = "afterhours-shift-manager-plan-refresh"
   role   = aws_iam_role.hcptf_plan.id

terraform/iam.tf

@@ -96,11 +96,14 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
     resources = [aws_sqs_queue.jobs.arn]
   }
 
-  statement {
+  dynamic "statement" {
+    for_each = var.checkcomponents_queue_arn == "" ? [] : [1]
+    content {
       sid       = "CheckcomponentsSend"
       effect    = "Allow"
       actions   = ["sqs:SendMessage"]
-    resources = compact([var.checkcomponents_queue_arn])
+      resources = [var.checkcomponents_queue_arn]
+    }
   }
 
   statement {

terraform/lambda.tf

@@ -57,7 +57,8 @@ locals {
         condition = null
       },
     ]
-    weekly_post = [
+    weekly_post = concat(
+      [
         {
           sid       = "DdbCrud"
           actions   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem", "dynamodb:DescribeTable", "dynamodb:ConditionCheckItem"]
@@ -70,13 +71,16 @@ locals {
           resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/slack-bot-token-*"]
           condition = null
         },
+      ],
+      var.checkcomponents_queue_arn == "" ? [] : [
         {
           sid       = "CheckcomponentsSend"
           actions   = ["sqs:SendMessage"]
           resources = [var.checkcomponents_queue_arn]
           condition = null
         },
-    ]
+      ],
+    ),
     roster_sync = [
       {
         sid       = "DdbCrud"

terraform/lambda_boundary.tf

@@ -121,7 +121,9 @@ data "aws_iam_policy_document" "lambda_boundary" {
     ]
   }
 
-  statement {
+  dynamic "statement" {
+    for_each = var.checkcomponents_queue_arn == "" ? [] : [1]
+    content {
       sid    = "AfterhoursCheckcomponentsSend"
       effect = "Allow"
       actions = [
@@ -132,6 +134,7 @@ data "aws_iam_policy_document" "lambda_boundary" {
       ]
     }
   }
+}
 
 resource "aws_iam_policy" "lambda_boundary" {
   name        = "afterhours-shift-manager-lambda-boundary"

terraform/vpc.tf

@@ -12,7 +12,10 @@ resource "aws_vpc" "this" {
   }
 
   # First apply updates the live hcptf apply role before CreateVpc.
-  depends_on = [aws_iam_role_policy.hcptf_apply_services]
+  depends_on = [
+    aws_iam_role_policy.hcptf_apply_services,
+    aws_iam_role_policy.hcptf_apply_ecs,
+  ]
 }
 
 resource "aws_internet_gateway" "this" {

tests/infra/test_hcp_contract.py

@@ -81,6 +81,8 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
     assert "aws_subnet.public[*].id" in ecs
     assert "ec2:CreateVpc" in HCP_IAM
     assert "sid    = \"RefreshVpc\"" in HCP_IAM
+    assert "afterhours-shift-manager-ecs" in HCP_IAM
+    assert "hcptf_apply_ecs" in HCP_IAM
 
 
 def test_deploy_api_workflow_exists():