From 87a430f3dc6582a1205cc73d7234c2b24bc159b1 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 2 Sep 2026 17:38:31 -0400
Subject: [PATCH] fix(iam): add apply-role IAM list permissions (PLAT-146)

IamReadOnly omitted ListRoleTags needed to refresh imported roles after detaching the substrate guardrail.
---
 terraform/hcp_iam.tf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 6b58548..93f25b5 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -137,9 +137,11 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       "iam:GetRole",
       "iam:GetRolePolicy",
       "iam:ListAttachedRolePolicies",
+      "iam:ListInstanceProfilesForRole",
       "iam:ListPolicies",
       "iam:ListPolicyVersions",
       "iam:ListRolePolicies",
+      "iam:ListRoleTags",
       "iam:ListRoles",
     ]
     resources = ["*"]