From a7352b2fac886f9152c43ef6644891109370cbcb Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 2 Sep 2026 17:38:42 -0400
Subject: [PATCH] fix(iam): add apply-role IAM list permissions (PLAT-146)

IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed to refresh imported roles after detaching the substrate guardrail.
---
 terraform/hcp_iam.tf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 91b3867..c40fc47 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -120,9 +120,11 @@ data "aws_iam_policy_document" "hcptf_scoped_iam" {
       "iam:GetRole",
       "iam:GetRolePolicy",
       "iam:ListAttachedRolePolicies",
+      "iam:ListInstanceProfilesForRole",
       "iam:ListPolicies",
       "iam:ListPolicyVersions",
       "iam:ListRolePolicies",
+      "iam:ListRoleTags",
       "iam:ListRoles",
     ]
     resources = ["*"]