add deny product updates to sc-servicecatalog t1 and t2

[morga471]

adds statements to deny the update of provisioned products.
2 reasons -

1. we haven't trained end users or created documentation to describe how to update products without breaking them
2. we don't currently have any products which would benefit from an update cycle, the better path if that is needed is to destroy and recreate the provisioned product.

This does not remove the capability from t3, as that is reserved for internal service catalog admins whom are the ones that would do this type of operation.

[morga471@iebcloud aws-sso]$ tf validate
Success! The configuration is valid.


real    0m0.040s
user    0m0.034s
sys     0m0.021s

PLANS:
sc-servicecatalog-t1 ->

Terraform will perform the following actions:

  # module.pset_sc-servicecatalog-t1.aws_ssoadmin_permission_set.pset will be updated in-place
  ~ resource "aws_ssoadmin_permission_set" "pset" {
        id               = "arn:aws-us-gov:sso:::permissionSet/ssoins-7857864625123d75/ps-d095ebb5c79d8221,arn:aws-us-gov:sso:::instance/ssoins-7857864625123d75"
        name             = "sc-servicecatalog-t1"
      ~ tags             = {
            "CostAllocation"        = "csvd:lab:management"
            "Environment"           = "infrastructure"
            "boc:created_by"        = "terraform"
            "boc:tf_module_name"    = "aws-sso/permissionset"
          ~ "boc:tf_module_version" = "1.4.0" -> "1.8.0"
            "finops_project_name"   = "inf_lab_idc"
            "finops_project_number" = "fs0000000002"
            "finops_project_role"   = "inf_lab_idc_permissionset"
        }
      ~ tags_all         = {
          ~ "boc:tf_module_version" = "1.4.0" -> "1.8.0"
            # (7 unchanged elements hidden)
        }
        # (7 unchanged attributes hidden)
    }

  # module.pset_sc-servicecatalog-t1.aws_ssoadmin_permission_set_inline_policy.pset[0] will be updated in-place
  ~ resource "aws_ssoadmin_permission_set_inline_policy" "pset" {
        id                 = "arn:aws-us-gov:sso:::permissionSet/ssoins-7857864625123d75/ps-d095ebb5c79d8221,arn:aws-us-gov:sso:::instance/ssoins-7857864625123d75"
      ~ inline_policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                          - "servicecatalog:UpdateProvisionedProduct",
                          - "servicecatalog:UpdateProvisionedProductProperties",
                          + "organizations:List*",
                          + "organizations:Describe*",
                          + "account:List*",
                          + "account:Get*",
                        ]
                      ~ Effect   = "Deny" -> "Allow"
                      + Sid      = "OnlyReadOperationsOnOrganizations"
                        # (1 unchanged attribute hidden)
                    },
                  + {
                      + Action   = [
                          + "servicecatalog:UpdateProvisionedProductProperties",
                          + "servicecatalog:UpdateProvisionedProduct",
                        ]
                      + Effect   = "Deny"
                      + Resource = "*"
                      + Sid      = "DenyProductUpdates"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (3 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

sc-servicecatalog-t2 ->

Terraform will perform the following actions:

  # module.pset_sc-servicecatalog-t2.aws_ssoadmin_permission_set.pset will be updated in-place
  ~ resource "aws_ssoadmin_permission_set" "pset" {
        id               = "arn:aws-us-gov:sso:::permissionSet/ssoins-7857864625123d75/ps-fa6aa376db2e7a15,arn:aws-us-gov:sso:::instance/ssoins-7857864625123d75"
        name             = "sc-servicecatalog-t2"
      ~ tags             = {
            "CostAllocation"        = "csvd:lab:management"
            "Environment"           = "infrastructure"
            "boc:created_by"        = "terraform"
            "boc:tf_module_name"    = "aws-sso/permissionset"
          ~ "boc:tf_module_version" = "1.6.1" -> "1.8.0"
            "finops_project_name"   = "inf_lab_idc"
            "finops_project_number" = "fs0000000002"
            "finops_project_role"   = "inf_lab_idc_permissionset"
        }
      ~ tags_all         = {
          ~ "boc:tf_module_version" = "1.6.1" -> "1.8.0"
            # (7 unchanged elements hidden)
        }
        # (7 unchanged attributes hidden)
    }

  # module.pset_sc-servicecatalog-t2.aws_ssoadmin_permission_set_inline_policy.pset[0] will be updated in-place
  ~ resource "aws_ssoadmin_permission_set_inline_policy" "pset" {
        id                 = "arn:aws-us-gov:sso:::permissionSet/ssoins-7857864625123d75/ps-fa6aa376db2e7a15,arn:aws-us-gov:sso:::instance/ssoins-7857864625123d75"
      ~ inline_policy      = jsonencode(
          ~ {
              ~ Statement = [
                    # (1 unchanged element hidden)
                    {
                        Action   = [
                            "ec2:StopInstances",
                            "ec2:StartInstances",
                            "ec2:RunInstances",
                            "ec2:RebootInstances",
                            "ec2:ModifyInstanceAttribute",
                            "ec2:GetSecurityGroupsForVpc",
                            "ec2:DescribeVolumesModifications",
                            "ec2:DescribeVolumes",
                            "ec2:DescribeVolumeStatus",
                            "ec2:DescribeVolumeAttribute",
                            "ec2:DescribeTags",
                            "ec2:DescribeSecurityGroups",
                            "ec2:DescribeSecurityGroupRules",
                            "ec2:AssociateSecurityGroupVpc",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "EC2Actions"
                    },
                  + {
                      + Action   = [
                          + "servicecatalog:UpdateProvisionedProductProperties",
                          + "servicecatalog:UpdateProvisionedProduct",
                        ]
                      + Effect   = "Deny"
                      + Resource = "*"
                      + Sid      = "DenyProductUpdates"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (3 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

plan.20260528.1779986743.log
plan.20260528.1779986987.log

[badra001]

OK