From 8343d572af087c64172e9d624880b33458956d2c Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Fri, 18 Sep 2026 14:45:49 -0400 Subject: [PATCH] fix(iam): ignore default tags on hcptf roles (PLAT-210) The apply role cannot iam:TagRole on itself. Provider default_tags from the env split 403'd the prod apply on hcptf-meal-order-manager and -plan. --- terraform/hcp_iam.tf | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf index 5ca7ae0..e891e94 100644 --- a/terraform/hcp_iam.tf +++ b/terraform/hcp_iam.tf @@ -719,6 +719,12 @@ resource "aws_iam_role" "hcptf_apply" { Owner = "adam@seahavenind.com" ManagedBy = "terraform" } + + # Apply role cannot iam:TagRole on itself. Provider default_tags + # (Environment/Workspace) would otherwise 403 mid-apply. + lifecycle { + ignore_changes = [tags] + } } # Empty exclusive set keeps seahaven-hcptf-iam-management detached. @@ -737,6 +743,11 @@ resource "aws_iam_role" "hcptf_plan" { Owner = "adam@seahavenind.com" ManagedBy = "terraform" } + + # Same self-tag restriction as hcptf_apply. + lifecycle { + ignore_changes = [tags] + } } resource "aws_iam_role_policy_attachment" "hcptf_plan_viewonly" {