9 commits

Author	SHA1	Message	Date
Adam Moussa	0857174b6d	fix(iam): grant frontend HCP plan named SSM describe and tag reads (PLAT-212)	2026-09-18 14:53:43 -04:00
Adam Moussa	707d795b47	fix(iam): allow frontend HCP apply to write deploy SSM and githubdeploy trust (PLAT-212)	2026-09-18 14:45:19 -04:00
Adam Moussa	a492a45e07	chore(iam): remove frontend tf-poc substrate after teardown (PLAT-194) (#146)	2026-09-11 22:17:00 +00:00
Adam Moussa	5d613c73bc	feat(iam): allow frontend tf-poc HCP apply destroy (PLAT-193) (#145)	2026-09-11 21:46:59 +00:00
Adam Moussa	3c54df6341	fix(iam): allow GitHub frontend deploy roles to GetDistribution (PLAT-192) (#144) ... Verify and live-state summary call get-distribution; the identity policy already granted it, but the permissions boundary denied the action.	2026-09-11 19:37:24 +00:00
Adam Moussa	60b978aa2a	feat(iam): allow frontend HCP apply to own release pointer and invalidation (PLAT-188) (#143) ... * feat(iam): allow frontend HCP apply to own release pointer and invalidation (PLAT-188) Plan and apply roles can read .release/current; apply can PutObject that key and CreateInvalidation on the exact distribution. * fix(iam): allow frontend HCP roles to tag the release pointer (PLAT-188) Terraform aws_s3_object lists object tags on every refresh, so plan and apply need GetObjectTagging and apply needs PutObjectTagging on the exact .release/current key.	2026-09-11 17:37:42 +00:00
Adam Moussa	0c6f307b61	feat(iam): allow frontend HCP apply to update exact CloudFront resources (PLAT-187) (#142) ... * feat(iam): allow frontend HCP apply to update exact CloudFront resources (PLAT-187) Phase 2 ownership tags cannot apply while UpdateDistribution and UpdateFunction are denied on *. Allow those two actions only on the pinned distribution and function ARNs. * fix(iam): allow PublishFunction on exact frontend CloudFront functions (PLAT-187) The AWS provider publishes after UpdateFunction, including tag-only applies, so denying PublishFunction on * still blocked Phase 2 function updates.	2026-09-11 15:08:21 +00:00
Adam Moussa	6d5811f08e	fix(iam): codify live terraform-substrate IAM (PLAT-142) (#135) ... * fix(iam): allow frontend import plan to read deploy boundaries * fix(iam): grant backend apply role EB UpdateEnvironment follow-on perms	2026-09-01 00:16:34 +00:00
Adam Moussa	6a0713f49d	feat(iam): add frontend Terraform substrate (#133) ... * feat(iam): add frontend Terraform substrate * fix(iam): align frontend Terraform substrate * feat(iam): enable frontend live Terraform roles	2026-08-31 02:25:47 +00:00