From 058db53acd0d4c6d489d2dc85435742c1433fec0 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 2 Sep 2026 18:01:10 -0400
Subject: [PATCH] fix(iam): allow ListPolicyTags on scoped IAM policy
 (PLAT-146)

tagged managed scoped IAM is refreshed with ListPolicyTags; apply IamReadOnly and plan-refresh omitted it.
---
 terraform/hcp_iam.tf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 3047199..5b3c2fe 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -199,6 +199,7 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       "iam:ListAttachedRolePolicies",
       "iam:ListInstanceProfilesForRole",
       "iam:ListPolicies",
+      "iam:ListPolicyTags",
       "iam:ListPolicyVersions",
       "iam:ListRolePolicies",
       "iam:ListRoles",
@@ -605,6 +606,7 @@ resource "aws_iam_role_policy" "hcptf_plan_refresh" {
         Action = [
           "iam:GetPolicy",
           "iam:GetPolicyVersion",
+          "iam:ListPolicyTags",
         ]
         Resource = "*"
         Effect   = "Allow"