adam/seahaven-org-baseline

Author	SHA1	Message	Date
Adam Moussa	34cb3c833f	feat(iam): allow PassRole to ECS tasks and EventBridge Scheduler A first apply of Fargate and Scheduler targets cannot create those service-linked attachments while PassRole is Lambda-only.	2026-09-21 14:37:53 -04:00
Adam Moussa	4f0d84cddb	fix(iam): use unique HCP bootstrap workspace names (PLAT-143) (#138 ) Some checks are pending Deploy / deploy-management (push) Waiting to run Details Deploy / deploy-external-dev (push) Waiting to run Details Deploy / deploy-security (push) Waiting to run Details Deploy / deploy-dev (push) Waiting to run Details Deploy / deploy-prod (push) Waiting to run Details HCP workspace names are org-unique, so prod and dev cannot both be iam-bootstrap. Pin trust to iam-bootstrap-prod and iam-bootstrap-dev.	2026-09-02 15:51:39 +00:00
Adam Moussa	b02f52b805	feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) (#137 ) * feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) * fix(iam): pin HCP boundary ARNs and bootstrap trust window (PLAT-143) Null on iam:PermissionsBoundary accepted any ceiling, including AdministratorAccess. Import apply cannot self-mutate hcptf-* while bootstrap trust is iam-bootstrap only; add a time-boxed exact StringEquals workspace grant instead of StringLike.	2026-09-02 15:22:48 +00:00