* iac(access): temporary shoc-assessment-dynamo-reader role for Luby initial assessment
30-day, read-only (GetItem/Query/Scan/DescribeTable) cross-account role in
seahaven-prod trusting seahaven-external-dev, trust-policy hard expiry
2026-08-23. Steady state remains procurement-api + webhook; teardown script
included.
* harden(access): resolve sh-security-review findings on assessment reader
C1 (confirmed medium): DateLessThan expiry condition duplicated into both
permissions statements so in-flight sessions die at the deadline, not +1h.
C2 (confirmed medium): teardown now strips ALL inline/attached policies and
instance profiles before DeleteRole (kill-switch semantics restored,
idempotent), emergency-revocation section added to README.
Cheap hardenings: CDPATH-immune SCRIPT_DIR, MaxSessionDuration re-asserted
on update path, data-handling expectations documented.
* harden(access): address Open SWE review on #141
- Trust now requires ArnLike aws:PrincipalArn on the Identity Center role
path (human SSO sessions only; string condition survives permission-set
reprovisioning, unlike a role-ARN Principal pin)
- README extend instructions cover BOTH expiry sites (trust + permissions)
- Create script logs caller ARN + timestamp and validates the policy's KMS
ARN against SSM /seahaven/dynamodb/cmk-arn before applying
