From 75888e045e01194776cce6cd0c5621532388ae89 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Tue, 14 Jul 2026 18:24:42 -0400
Subject: [PATCH] Extend deny-root-user SCP to the external-dev OU (#51)

Extdev root credentials were deleted 2026-07-14 via centralized root
management (four-surface verified), closing the deferred root-hardening
blocker. Root recovery is central (assume-root, drill-proven) plus a
temporary gated detach, so the OU now gets the same root lockout as the
other six.

Gates: GPT-4.1 cross-review APPROVE; /sh-security-review PASS (0 confirmed
critical/high). Note: this attach puts the extdev OU at the 5-SCP hard
quota - future guardrails attach at the account or consolidate.
---
 lib/org-governance-stack.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/org-governance-stack.ts b/lib/org-governance-stack.ts
index 41b42e9..d680b89 100644
--- a/lib/org-governance-stack.ts
+++ b/lib/org-governance-stack.ts
@@ -305,6 +305,7 @@ export class OrgGovernanceStack extends cdk.Stack {
         securityOu.attrId,
         sandboxOu.attrId,
         graveyardOu.attrId,
+        "ou-nbuj-q34yz3ql", // external-dev (imported below; literal id matches its other SCP attachments)
       ],
       content: {
         Version: "2012-10-17",