adam/meal-order-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/meal-order-manager.git synced 2026-09-30 06:33:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): ignore default tags on hcptf roles (PLAT-210)

Browse source 
The apply role cannot iam:TagRole on itself. Provider default_tags from
the env split 403'd the prod apply on hcptf-meal-order-manager and -plan.
This commit is contained in:
Adam Moussa 2026-09-18 14:45:49 -04:00
parent 44c79fdefd
commit 8343d572af
No known key found for this signature in database
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
terraform/hcp_iam.tf
View file

@ -719,6 +719,12 @@ resource "aws_iam_role" "hcptf_apply" {
Owner = "adam@seahavenind.com"
ManagedBy = "terraform"
}
# Apply role cannot iam:TagRole on itself. Provider default_tags
# (Environment/Workspace) would otherwise 403 mid-apply.
lifecycle {
ignore_changes = [tags]
}
}
# Empty exclusive set keeps seahaven-hcptf-iam-management detached.
@ -737,6 +743,11 @@ resource "aws_iam_role" "hcptf_plan" {
Owner = "adam@seahavenind.com"
ManagedBy = "terraform"
}
# Same self-tag restriction as hcptf_apply.
lifecycle {
ignore_changes = [tags]
}
}
resource "aws_iam_role_policy_attachment" "hcptf_plan_viewonly" {