From e858eb580b2fe927b670db310ccd89d1f64c6175 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 14:55:32 -0400
Subject: [PATCH] fix(iam): ignore tags_all on hcptf roles (PLAT-210)

ignore_changes on tags does not cover provider default_tags. The prod
speculative plan still wanted Environment on tags_all and would TagRole.
---
 terraform/hcp_iam.tf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index e891e94..a5fc6eb 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -721,9 +721,9 @@ resource "aws_iam_role" "hcptf_apply" {
   }
 
   # Apply role cannot iam:TagRole on itself. Provider default_tags
-  # (Environment/Workspace) would otherwise 403 mid-apply.
+  # merge into tags_all, so ignoring tags alone still 403s mid-apply.
   lifecycle {
-    ignore_changes = [tags]
+    ignore_changes = [tags, tags_all]
   }
 }
 
@@ -746,7 +746,7 @@ resource "aws_iam_role" "hcptf_plan" {
 
   # Same self-tag restriction as hcptf_apply.
   lifecycle {
-    ignore_changes = [tags]
+    ignore_changes = [tags, tags_all]
   }
 }