From 03dc0b7ac9e60d5bde3b591dfe4cca5864867220 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 2 Sep 2026 17:38:43 -0400
Subject: [PATCH] fix(iam): add apply-role IAM list permissions (PLAT-146)

IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed after detaching the substrate guardrail.
---
 terraform/hcp_iam.tf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 05c17c6..fb806c1 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -185,10 +185,12 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       "iam:GetRole",
       "iam:GetRolePolicy",
       "iam:ListAttachedRolePolicies",
+      "iam:ListInstanceProfilesForRole",
       "iam:ListPolicies",
       "iam:ListPolicyVersions",
       "iam:ListRolePolicies",
       "iam:ListRoles",
+      "iam:ListRoleTags",
     ]
     resources = ["*"]
   }