From 21761c020c360d99082abd8add441c1870fc934c Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 2 Sep 2026 17:38:48 -0400
Subject: [PATCH] fix(iam): add apply-role IAM list permissions (PLAT-146)

IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed after detaching the substrate guardrail.
---
 terraform/hcp_iam.tf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index e4a3ed4..9a98f28 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -202,9 +202,11 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       "iam:GetRole",
       "iam:GetRolePolicy",
       "iam:ListAttachedRolePolicies",
+      "iam:ListInstanceProfilesForRole",
       "iam:ListPolicies",
       "iam:ListPolicyVersions",
       "iam:ListRolePolicies",
+      "iam:ListRoleTags",
       "iam:ListRoles",
     ]
     resources = ["*"]