Fix trusted_arns for 289256138624 and clean up 493370826424

[akuzminsky]

Summary

• Add ih-tf-github-control-github (303467602807) to trusted_arns in the 289256138624 gha-admin module, fixing github-control CI/CD access to the admin role
• Remove unused ih-tf-aws-control-303467602807-read-only from allowed_arns in the 493370826424 module (no longer needed after hardcoding NS servers)

Test plan

• terraform plan shows trust policy update on ih-tf-aws-control-289256138624-admin and policy update on ih-tf-aws-control-493370826424-github
• github-control CI/CD can assume ih-tf-aws-control-289256138624-admin after apply

🤖 Generated with Claude Code

[github-actions]

State s3://infrahouse-aws-control-990466748045/terraform.tfstate

Affected resources counts

Success	Add	🟡 Change	Destroy
✅	0	4	0

Affected resources by action

Action	Resources
🟡	module.ih_tf_aws_control_289256138624.aws_iam_policy.github
🟡	module.ih_tf_aws_control_289256138624.aws_iam_role.admin
🟡	module.ih_tf_aws_control_493370826424.aws_iam_policy.github
🟡	module.ih_tf_aws_control_289256138624.module.state-manager.aws_iam_role.state-manager

STDOUT

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
 <= read (data resources)

Terraform will perform the following actions:

  # module.ih_tf_aws_control_289256138624.data.aws_iam_policy_document.github-permissions will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "github-permissions" {
      + id            = (known after apply)
      + json          = (known after apply)
      + minified_json = (known after apply)

      + statement {
          + actions   = [
              + "sts:AssumeRole",
            ]
          + resources = [
              + "arn:aws:iam::289256138624:role/ih-tf-aws-control-289256138624-admin",
              + "arn:aws:iam::289256138624:role/ih-tf-aws-control-289256138624-state-manager",
            ]
        }
    }

  # module.ih_tf_aws_control_289256138624.aws_iam_policy.github will be updated in-place
  ~ resource "aws_iam_policy" "github" {
        id               = "arn:aws:iam::289256138624:policy/ih-tf-aws-control-289256138624-github20260219215208187100000001"
        name             = "ih-tf-aws-control-289256138624-github20260219215208187100000001"
      ~ policy           = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "sts:AssumeRole"
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:iam::289256138624:role/ih-tf-aws-control-289256138624-state-manager",
                          - "arn:aws:iam::289256138624:role/ih-tf-aws-control-289256138624-admin",
                        ]
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        tags             = {
            "created_by_module" = "infrahouse/gha-admin/aws"
        }
        # (7 unchanged attributes hidden)
    }

  # module.ih_tf_aws_control_289256138624.aws_iam_role.admin will be updated in-place
  ~ resource "aws_iam_role" "admin" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = [
                                # (1 unchanged element hidden)
                                "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-github",
                              + "arn:aws:iam::303467602807:role/ih-tf-github-control-github",
                                "arn:aws:iam::289256138624:role/ih-tf-aws-control-289256138624-github",
                            ]
                        }
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        id                    = "ih-tf-aws-control-289256138624-admin"
        name                  = "ih-tf-aws-control-289256138624-admin"
        tags                  = {
            "created_by_module" = "infrahouse/gha-admin/aws"
            "module_version"    = "3.6.1"
        }
        # (11 unchanged attributes hidden)
    }

  # module.ih_tf_aws_control_493370826424.aws_iam_policy.github will be updated in-place
  ~ resource "aws_iam_policy" "github" {
        id               = "arn:aws:iam::493370826424:policy/ih-tf-aws-control-493370826424-github20260219225906427200000002"
        name             = "ih-tf-aws-control-493370826424-github20260219225906427200000002"
      ~ policy           = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                            "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-admin",
                          - "arn:aws:iam::303467602807:role/ih-tf-aws-control-303467602807-read-only",
                            "arn:aws:iam::289256138624:role/ih-tf-aws-control-493370826424-state-manager",
                            # (1 unchanged element hidden)
                        ]
                        # (2 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags             = {
            "created_by_module" = "infrahouse/gha-admin/aws"
        }
        # (7 unchanged attributes hidden)
    }

  # module.ih_tf_aws_control_289256138624.module.state-manager.aws_iam_role.state-manager will be updated in-place
  ~ resource "aws_iam_role" "state-manager" {
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Principal = {
                          ~ AWS = [
                                # (1 unchanged element hidden)
                                "arn:aws:iam::493370826424:role/ih-tf-aws-control-493370826424-github",
                              + "arn:aws:iam::303467602807:role/ih-tf-github-control-github",
                                "arn:aws:iam::289256138624:role/ih-tf-aws-control-289256138624-github",
                            ]
                        }
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        id                    = "ih-tf-aws-control-289256138624-state-manager"
        name                  = "ih-tf-aws-control-289256138624-state-manager"
        tags                  = {
            "created_by_module" = "infrahouse/state-manager/aws"
            "module_version"    = "1.4.2"
        }
        # (11 unchanged attributes hidden)
    }

Plan: 0 to add, 4 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"

metadata

eyJzMzovL2luZnJhaG91c2UtYXdzLWNvbnRyb2wtOTkwNDY2NzQ4MDQ1L3RlcnJhZm9ybS50ZnN0YXRlIjogeyJzdWNjZXNzIjogdHJ1ZSwgImFkZCI6IDAsICJjaGFuZ2UiOiA0LCAiZGVzdHJveSI6IDB9fQ==