Repository navigation

fix(iam): drain remaining deploy-role grant gaps and pin them with tests - #1782

Merged

cristim merged 7 commits into

mainfrom

chore/aws-deploy-role-grant-gaps

Nov 5, 2026

Merged

fix(iam): drain remaining deploy-role grant gaps and pin them with tests#1782
cristim merged 7 commits into
mainfrom
chore/aws-deploy-role-grant-gaps

Commits on Nov 5, 2026
- test(iam): add a grantNeed helper to check deploy grants against real ARNs
  
  cristim
  and
  claude
  committed
  da4a185
- fix(iam): drop unmatchable RDS proxy resource scopes
  
  cristim
  and
  claude
  committed
  cef804b
- test(iam): pin monitoring and migration-alarm deploy grants
  
  cristim
  and
  claude
  committed
  04e2ffa
- docs(lambda): point the migration alarm gate at policy_monitoring
  
  cristim
  and
  claude
  committed
  4f48ac0
- fix(iam): grant acm tag removal and log retention removal
  
  cristim
  and
  claude
  committed
  94a0cee
- fix(iam): grant hosted zone lifecycle for the subdomain zone
  
  cristim
  and
  claude
  committed
  1fb4332
- test(iam): follow decision A in the RDS proxy tripwire and bound the new grants
  
  cristim
  and
  claude
  committed
  5f738f6