4 commits

Author	SHA1	Message	Date
Adam Moussa	b02f52b805	feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) (#137) ... * feat(iam): lock app-owned HCP IAM and add bootstrap SCP (PLAT-143) * fix(iam): pin HCP boundary ARNs and bootstrap trust window (PLAT-143) Null on iam:PermissionsBoundary accepted any ceiling, including AdministratorAccess. Import apply cannot self-mutate hcptf-* while bootstrap trust is iam-bootstrap only; add a time-boxed exact StringEquals workspace grant instead of StringLike.	2026-09-02 15:22:48 +00:00
Adam Moussa	6a0713f49d	feat(iam): add frontend Terraform substrate (#133) ... * feat(iam): add frontend Terraform substrate * fix(iam): align frontend Terraform substrate * feat(iam): enable frontend live Terraform roles	2026-08-31 02:25:47 +00:00
Adam Moussa	dba0871587	feat(iam): add external-dev backend Terraform substrate (#131) ... * feat(iam): add external-dev backend terraform substrate * fix(iam): require boundaries for SHOC policy writes	2026-08-29 21:04:40 +00:00
Adam Moussa	10e66c92c0	Adopt external-dev OU and its 3 SCPs via resource import (#45) ... cdk import by Id (non-mutating), content byte-exact from describe-policy, targetIds = exact live attachments. Post-import drift detection: IN_SYNC, 0 drifted. All four Retain — the full org guardrail set is now drift-checked IaC.	2026-07-14 14:10:10 -04:00