Adam Moussa 8cbc98d927 feat(scp): deny iam changes on the platform path (PLAT-233) (#159) ... * feat(scp): deny iam changes on role/platform unless the platform principal (PLAT-233) Adds ProtectPlatformPath beside the existing name denies in the prod/nonprod SCP and the security OU copy. New hcptf-bootstrap creates use /platform/. Existing roles are not recreated. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> * fix(scp): use live bootstrap ARNs and close the platform path gaps (PLAT-233) Resolve simulate and printed role ARNs from iam:GetRole so a /platform/ create is not reported as an unpathed role. Deny boundary changes on role/platform/*, and match both Identity Center SSO role ARN shapes. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> * fix(scp): deny platform-path changes in bootstrap simulate (PLAT-233) Add a simulate case for role/platform/hcptf-example and fail when CreateRole, PutRolePolicy, or DeleteRole is allowed. The unpathed hcptf-* import check stays. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>		2026-09-28 16:27:10 +00:00
..
external-dev-iam-guardrails.json	fix(iam): allow shoc-backend HCP apply to write deploy SSM and matching githubdeploy trust (PLAT-148) (#148)	2026-09-18 18:13:01 +00:00
external-dev-protect-security.json	Adopt external-dev OU and its 3 SCPs via resource import (#45)	2026-07-14 14:10:10 -04:00
external-dev-region-lock.json	Adopt external-dev OU and its 3 SCPs via resource import (#45)	2026-07-14 14:10:10 -04:00
external-dev-shoc-backend-deploy-trust.json	fix(iam): allow frontend HCP apply to write deploy SSM and githubdeploy trust (PLAT-212) (#150)	2026-09-18 21:37:05 +00:00
protect-privileged-roles.json	feat(scp): deny iam changes on the platform path (PLAT-233) (#159)	2026-09-28 16:27:10 +00:00