fix(iac): close latent Terraform audit findings (IaC-1..4) + executable trivy gate

[brownjuly2003-code]

Closes the four latent findings of the 2026-07-18 IaC audit addendum (P4.1–P4.4 of the audit plan). All of this Terraform is currently unapplied (terraform-apply.yml plan/apply are if: false), so these are configuration fixes to land before AWS apply is ever re-enabled — no live infrastructure changes.

IaC-1 (P2) — MSK plaintext + no client auth

• client_broker = "TLS" and client_authentication { sasl { iam = true } } on the MSK cluster.
• Flink switched to the SASL/IAM bootstrap output, SigV4 client properties added, and a new scoped kafka-cluster:* data-plane policy on the Flink service role (cluster/topic/group ARNs derived from the cluster ARN).
• Broker SG ingress narrowed from 10.0.0.0/8 to the CIDRs of the cluster's own subnets (data-sourced from the passed subnet ids).

IaC-2 (P2) — deploy-role self-escalation

• New permissions boundary policy attached to the deploy role, and required (via iam:PermissionsBoundary condition) on any role it creates or re-policies. Flink/Grafana service roles now carry the boundary.
• Identity policy: mutation verbs dropped for the role's own agentflow-terraform-* pattern (read-only state refresh kept). Changes to the deploy role/policy and the boundary itself become out-of-band admin operations (no CreatePolicyVersion/SetDefaultPolicyVersion/DeletePolicy on the boundary; explicit denies on boundary detach).

IaC-3 (P3) — OIDC provider wildcard verbs

iam:*OpenIDConnectProvider* on * split into List on * plus explicit verbs pinned to the single provider ARN this module manages.

IaC-4 (P3) — service-scope wildcard verbs

kafka:*Cluster*, kafka:*Configuration*, kinesisanalytics:*Application* replaced with explicit verb lists scoped to project ARN patterns; destructive operations (cluster/application/workspace/SG/KMS-key deletion) additionally gated on the Project resource tag. CloudWatch alarm verbs scoped to the agentflow-* alarm pattern.

Raised by the scanner while getting the gate green, also fixed

• CMKs (with rotation) for MSK and lake-bucket at-rest encryption instead of implicit AWS-managed keys; Flink role granted use of the lake key; deploy role granted scoped KMS lifecycle verbs.
• SG egress: kafka restricted to cluster subnets, flink to kafka ports + 443.
• Remaining deliberate wildcards (Describe*/generated-id resources, boundary ceiling) suppressed inline with per-statement justification comments.

P4.4 — executable gate

New iac job in security.yml (runs on PR + push to main, same pinned trivy-action): trivy config over infrastructure/terraform, severity MEDIUM+, exit-code: 1, SARIF uploaded under its own category.

Verified locally: terraform validate clean; trivy on main's tree exits 1 (flags client_broker = "TLS_PLAINTEXT", CRITICAL), on this branch exits 0.

Note: terraform plan against real AWS is impossible here (apply lane disabled, no credentials) — placeholder tfvars only. IAM verb lists follow the AWS provider's documented call patterns; if a verb is missing it surfaces at the first real plan/apply, which is already gated behind workflow_dispatch + environment review.

🤖 Generated with Claude Code

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 110 total / 25.67 per week
• Lead time for changes: avg 0.59h / median 0.0h
• Change failure rate: 75.45% (83/110)
• MTTR: 20.13h across 5 incident(s)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.