From c9763676e191559aec1313acf98a3623210013b8 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 2 Sep 2026 17:38:48 -0400
Subject: [PATCH] fix(iam): add apply-role IAM list permissions (PLAT-146)

apply-role IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed after detaching the substrate guardrail.
---
 terraform/hcp_iam.tf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 5b323d9..3873a84 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -185,9 +185,11 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       "iam:GetRole",
       "iam:GetRolePolicy",
       "iam:ListAttachedRolePolicies",
+      "iam:ListInstanceProfilesForRole",
       "iam:ListPolicies",
       "iam:ListPolicyVersions",
       "iam:ListRolePolicies",
+      "iam:ListRoleTags",
       "iam:ListRoles",
     ]
     resources = ["*"]