Added optional permissions_boundary to roles

[ian-ridehalgh-n]

Added a new input variable, permissions_boundary_arn, with a default of null.

Permissions boundary is an optional aws_iam_role arguement which will be treated as unset when null, meaning the change is backward compatible

[github-actions]

☂️ Code Coverage

current status: ✅

Overall Coverage

Statements	Covered	Coverage	Threshold	Status
627	560	89%	65%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 0851eef by action🐍

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Adds optional IAM permissions boundaries to every IAM role created by the Terraform module while preserving existing behavior by default.

Changes:

• Adds the nullable permissions_boundary_arn input.
• Applies the boundary to all ten IAM roles.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
module/variables.tf	Defines the optional boundary ARN input.
module/stepfunctions_send_message.tf	Applies it to the send workflow role.
module/stepfunctions_get_messages.tf	Applies it to the receive workflow role.
module/lambda_send_message_chunk.tf	Applies it to the chunk-sending role.
module/lambda_poll_mailbox.tf	Applies it to the mailbox polling role.
module/lambda_fetch_message_chunk.tf	Applies it to the chunk-fetching role.
module/lambda_check_send_parameters.tf	Applies it to the parameter-checking role.
module/eventbridge_send_message.tf	Applies it to the send event role.
module/eventbridge_get_messages.tf	Applies it to the receive event role.
module/eventbridge_get_messages_handshake.tf	Applies it to the handshake event role.
module/cloudtrail.tf	Applies it to the CloudTrail role.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[johnwilliams57-nhs]

this looks like a safe, opt-in addition to support permissions boundaries.
thanks Ian.