From ca9772ade3a104587e532d694c7c7f426edc7adb Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 16 Sep 2026 17:27:24 -0400
Subject: [PATCH] fix(infra): allow scoped apply to modify SG rules in place

Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
---
 terraform/hcp_iam.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 2d7624c..d165f89 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -368,6 +368,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "ec2:DetachInternetGateway",
       "ec2:DisassociateAddress",
       "ec2:DisassociateRouteTable",
+      "ec2:ModifySecurityGroupRules",
       "ec2:ModifySubnetAttribute",
       "ec2:ModifyVpcAttribute",
       "ec2:ReleaseAddress",