Fix ECR deploy race condition and document developer IAM policy

[ramesh-maddegoda]

🗒️ Summary

This pull request fixes a race condition that occasionally encountered when deploying to images to ECR. Also, this provides documentation of creating a suitable developer IAM policy with necessary permissions, if we do the deployment in two steps: Deploy IAM fist, deploy other resources next.

🤖 AI Assistance Disclosure

• No AI assistance used
• AI used for light assistance (e.g., suggestions, refactoring, documentation help, minor edits)
• AI used for moderate content generation (AI generated some code or logic, but the developer authored or heavily revised the majority)
• AI generated substantial portions of this code

Estimated % of code influenced by AI: 95 %

⚙️ Test Data and/or Report

Tested by completely destroying the environment and recreating the it with two steps: Deploy IAM fist, deploy other resources next.

♻️ Related Issues

Improve PDS Nucleus pipeline scalability for terabyte to petabyte-scale data ingestion
#205

🤓 Reviewer Checklist

Reviewers: Please verify the following before approving this pull request.

Documentation and PR Content

• Documentation: README, Wiki, or inline documentation (Sphinx, Javadoc, Docstrings) have been updated to reflect these changes.
• Issue Traceability: The PR is linked to a valid GitHub Issue
• PR Title: The PR title is "user-friendly" clearly identifying what is being fixed or the new feature being added, that if you saw it in the Release Notes for a tool, you would be able to get the gist of what was done.

Security & Quality

• SonarCloud: Confirmed no new High or Critical security findings.
• Secrets Detection: Verified that the Secrets Detection scan passed and no sensitive information (keys, tokens, PII) is exposed.
• Code Quality: Code follows organization style guidelines and best practices for the specific language (e.g., PEP 8, Google Java Style).

Testing & Validation

• Test Accuracy: Verified that test data is accurate, representative of real-world PDS4 scenarios, and sufficient for the logic being tested.
• Coverage: Automated tests cover new logic and edge cases.
• Local Verification: (If applicable) Successfully built and ran the changes in a local or staging environment.

Maintenance

• Backward Compatibility: Confirmed that these changes do not break existing downstream dependencies or API contracts (or that breaking changes are clearly documented).

Terraform (only if this PR touches a terraform/ directory)

• Validator run: scripts/validate_terraform.py was run against the changed terraform/ tree and any Must-Have failures were resolved (or are tracked in a reviewed .tfvalidate-ignore entry, not silently bypassed).
• Ownership boundary: Shared/singleton CDS resources (Cognito, CloudFront, org-wide IAM roles, shared security groups) were only added/changed in pdc-cds-infra, not duplicated in an application repo.
• Module structure: modules/ stays flat and no new module is just a thin wrapper around a single resource.
• SSM interface: Any new cross-component output is actually published under /pds/<component>/... and, if this PR is the consumer side, reads from the correct published parameter rather than another repo's Terraform state.
• Naming intent: Resource and variable names are semantically meaningful, not just non-redundant (the validator only checks for repeated resource-type substrings).
• Auth at runtime: Terraform/CI actually authenticates via OIDC or an assumed role when applied — not just "no static key found in this diff."
• Least privilege: Any new or changed IAM policy attached to the Terraform execution role grants only what this change needs.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[nutjob4life]

AWS docs explicitly says no permision is required for GetCallerIdentity (even when it says Deny!) so this inclusion shouldn't be necessary.

[nutjob4life]

Is this sufficient? The data source mcp_operator_policy identifies policies by name but the AWS provider searches using the AWS API ListPolicies, which needs to enumerate them. You might need:

{
  "Sid": "FindExternalPermissionBoundaryPolicy",
  "Effect": "Allow",
  "Action": "iam:ListPolicies",
  "Resource": "*" // must be "*", but is at least read-only
},
{
  "Sid": "ReadExternalPermissionBoundaryPolicy",
  "Effect": "Allow",
  "Action": "iam:GetPolicy",
  "Resource": "arn:aws:iam::*:policy/mcp-tenantOperator-APIG"
}

[nutjob4life]

Thanks @ramesh-maddegoda this looks great.

Approved: ✅

I did leave a couple comments intersperesed but I don't think they're blockers for merging. Take a look and see what you think. Thanks again!

[ramesh-maddegoda]

Thanks @ramesh-maddegoda this looks great.

Approved: ✅

I did leave a couple comments intersperesed but I don't think they're blockers for merging. Take a look and see what you think. Thanks again!

Thanks @nutjob4life for your review!