npm - @empire-builder-kit/nx - Versions diffs - 1.0.0-rc.30 → 1.0.0-rc.31 - Mend

@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (261) hide show

package/src/aws-authority/stage-authority.js ADDED Viewed

@@ -0,0 +1,2836 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = exports.STAGE_RUNTIME_GLOBAL_ACTIONS = exports.STAGE_RUNTIME_REGIONAL_ACTIONS = exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = exports.STAGE_AUTHORITY_PARTITIONS = exports.STAGE_AUTHORITY_STAGES = exports.STAGE_AUTHORITY_SCHEMA_VERSION = void 0;
+exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = void 0;
+exports.createStageAuthorityIdentity = createStageAuthorityIdentity;
+exports.canonicalStageAuthorityTemplate = canonicalStageAuthorityTemplate;
+exports.digestStageAuthorityTemplate = digestStageAuthorityTemplate;
+exports.createStageAuthorityPlan = createStageAuthorityPlan;
+exports.createStageIamBoundaryTransformContract = createStageIamBoundaryTransformContract;
+exports.installStageIamBoundaryTransforms = installStageIamBoundaryTransforms;
+const node_crypto_1 = require("node:crypto");
+exports.STAGE_AUTHORITY_SCHEMA_VERSION = 1;
+exports.STAGE_AUTHORITY_STAGES = [
+    'development',
+    'staging',
+    'production',
+];
+exports.STAGE_AUTHORITY_PARTITIONS = [
+    'aws',
+    'aws-cn',
+    'aws-us-gov',
+];
+exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = [
+    'read',
+    'regional-mutation',
+    'global-iam-mutation',
+    'global-resource-mutation',
+    'generated-resource-mutation',
+    'stage-containment',
+    'permission-guardrails',
+    'guardrails',
+];
+exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = 6_144;
+exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = 200;
+exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = 51_200;
+const STAGE_AUTHORITY_MAX_AWS_PRINCIPALS = 16;
+const STAGE_AUTHORITY_MAX_AWS_PRINCIPAL_ARN_BYTES = 2_048;
+const ACCOUNT_ID = /^\d{12}$/u;
+const REGION = /^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\d$/u;
+const AWS_PRINCIPAL_ARN = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):role\/[A-Za-z0-9+=,.@_/-]+$/u;
+const GITHUB_OIDC_PROVIDER_ARN = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):oidc-provider\/token[.]actions[.]githubusercontent[.]com$/u;
+const GITHUB_SUBJECT = /^repo:(?:[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+|[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}\/[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}):environment:(development|staging|production)$/u;
+/** Native lifecycle required by the generated machine-authorization nested
+ * stack. Recovery-only and stack-policy mutation APIs remain ungranted. */
+exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = Object.freeze([
+    'cloudformation:CreateStack',
+    'cloudformation:DeleteStack',
+    'cloudformation:UpdateStack',
+].sort(compareStrings));
+/** EventBridge archives expose no request-tag or resource-tag IAM condition
+ * keys. Their lifecycle is contained by the exact canonical archive ARN and
+ * requested Region instead. */
+exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = Object.freeze([
+    'events:CreateArchive',
+]);
+exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = Object.freeze(['events:DeleteArchive', 'events:UpdateArchive'].sort(compareStrings));
+exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = Object.freeze([
+    'lambda:InvokeFunction',
+]);
+exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = Object.freeze([
+    'cloudfront:CreateInvalidation',
+]);
+exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = Object.freeze([
+    'wafv2:PutLoggingConfiguration',
+]);
+/** SST's CloudFront-scope WAF logging component owns exactly one generated log
+ * group in the edge control Region. These resource-capable actions stay bound
+ * to that generated ARN below. */
+exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = Object.freeze([
+    'logs:CreateLogGroup',
+    'logs:DeleteLogGroup',
+    'logs:DeleteRetentionPolicy',
+    'logs:PutRetentionPolicy',
+    'logs:TagLogGroup',
+    'logs:TagResource',
+    'logs:UntagLogGroup',
+    'logs:UntagResource',
+].sort(compareStrings));
+/** CloudWatch Logs exposes these WAF delivery mutations only at account scope.
+ * In particular, PutResourcePolicy supports neither resource ARNs nor
+ * action-specific condition keys. Requested Region and reviewed generated
+ * source are therefore the strongest honest controls for that one exception. */
+exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = Object.freeze([
+    'logs:CreateLogDelivery',
+    'logs:DeleteLogDelivery',
+    'logs:PutResourcePolicy',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = Object.freeze(['budgets:ModifyBudget', 'budgets:TagResource', 'budgets:UntagResource'].sort(compareStrings));
+exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = Object.freeze([
+    'rds:AddSourceIdentifierToSubscription',
+    'rds:RemoveSourceIdentifierFromSubscription',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = Object.freeze([
+    'kms:EnableKeyRotation',
+]);
+/** Commercial AWS exposes CloudFront, CloudFront-scope WAF, and edge
+ * certificates through us-east-1 even when the application stage is deployed
+ * elsewhere. This batch intentionally preserves the selected Region for
+ * nonstandard partitions; CloudFront is not available inside GovCloud. */
+function edgeControlRegion(partition, deploymentRegion) {
+    return partition === 'aws' ? 'us-east-1' : deploymentRegion;
+}
+/** Cost Explorer creation is account-global, while existing anomaly controls
+ * support account-bound ARNs. These exact verbs are admitted only to the
+ * production stage role below. */
+exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = Object.freeze([
+    'ce:GetAnomalyMonitors',
+    'ce:GetAnomalySubscriptions',
+    'ce:ListTagsForResource',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = Object.freeze(['ce:CreateAnomalyMonitor', 'ce:CreateAnomalySubscription'].sort(compareStrings));
+exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = Object.freeze([
+    'ce:DeleteAnomalyMonitor',
+    'ce:DeleteAnomalySubscription',
+    'ce:TagResource',
+    'ce:UntagResource',
+    'ce:UpdateAnomalyMonitor',
+    'ce:UpdateAnomalySubscription',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS,
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = Object.freeze([
+    'access-analyzer:Get*',
+    'access-analyzer:List*',
+    'acm:Describe*',
+    'acm:Get*',
+    'acm:List*',
+    'application-autoscaling:Describe*',
+    'appconfig:Get*',
+    'appconfig:List*',
+    'backup:Describe*',
+    'backup:Get*',
+    'backup:List*',
+    'cloudformation:Describe*',
+    'cloudformation:Get*',
+    'cloudformation:List*',
+    'cloudformation:ValidateTemplate',
+    'cloudwatch:Describe*',
+    'cloudwatch:Get*',
+    'cloudwatch:List*',
+    'cognito-idp:Describe*',
+    'cognito-idp:Get*',
+    'cognito-idp:List*',
+    'dynamodb:Describe*',
+    'dynamodb:Get*',
+    'dynamodb:List*',
+    'ec2:Describe*',
+    'ec2:GetInstanceUefiData',
+    'ec2:GetResourcePolicy',
+    'ecr:Describe*',
+    'ecr:Get*',
+    'ecr:List*',
+    'ecs:Describe*',
+    'ecs:List*',
+    'elasticloadbalancing:Describe*',
+    'events:Describe*',
+    'events:List*',
+    'kms:Describe*',
+    'kms:Get*',
+    'kms:List*',
+    'lambda:Get*',
+    'lambda:List*',
+    'logs:Describe*',
+    'logs:FilterLogEvents',
+    'logs:Get*',
+    'logs:List*',
+    'rds:Describe*',
+    'rds:List*',
+    'secretsmanager:Describe*',
+    'secretsmanager:Get*',
+    'secretsmanager:List*',
+    'servicequotas:Get*',
+    'servicequotas:List*',
+    'servicediscovery:Get*',
+    'servicediscovery:List*',
+    'sns:Get*',
+    'sns:List*',
+    'sqs:Get*',
+    'sqs:List*',
+    'ssm:Describe*',
+    'ssm:Get*',
+    'ssm:List*',
+    'states:Describe*',
+    'states:List*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = Object.freeze([
+    'apigateway:GET',
+    'budgets:Describe*',
+    'budgets:List*',
+    'budgets:ViewBudget',
+    'cloudfront-keyvaluestore:DescribeKeyValueStore',
+    'cloudfront-keyvaluestore:GetKey',
+    'cloudfront-keyvaluestore:ListKeys',
+    'cloudfront:Describe*',
+    'cloudfront:Get*',
+    'cloudfront:List*',
+    'iam:Get*',
+    'iam:List*',
+    'route53:Get*',
+    'route53:List*',
+    's3:Get*',
+    's3:List*',
+    'sts:GetCallerIdentity',
+    'tag:GetResources',
+    'wafv2:Get*',
+    'wafv2:List*',
+].sort(compareStrings));
+/** CloudFront-scope WAF publishes its observability signals through the edge
+ * control Region. Keep this read surface exact instead of broadening every
+ * regional read when the application Region differs from us-east-1. */
+exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = Object.freeze([
+    'cloudwatch:GetMetricData',
+    'logs:DescribeLogGroups',
+    'logs:DescribeResourcePolicies',
+].sort(compareStrings));
+/** A deployment role is a temporary infrastructure administrator, not a
+ * runtime workload identity. Routine regional services therefore use one
+ * stable service-family contract instead of a provider-call inventory. The
+ * families whose policy, protection, launch, or trust semantics need tighter
+ * treatment remain on the bounded action sets below. */
+exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = Object.freeze([
+    'acm:*',
+    'apigateway:*',
+    'appconfig:*',
+    'application-autoscaling:*',
+    'cloudwatch:*',
+    'cognito-idp:*',
+    'dynamodb:*',
+    'ecr:*',
+    'ecs:*',
+    'elasticloadbalancing:*',
+    'events:*',
+    'logs:*',
+    'rds:*',
+    'secretsmanager:*',
+    'servicediscovery:*',
+    'sns:*',
+    'sqs:*',
+    'ssm:*',
+    'states:*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'backup:CreateBackupPlan',
+    'backup:CreateBackupSelection',
+    'backup:CreateBackupVault',
+    'backup:DeleteBackupPlan',
+    'backup:DeleteBackupSelection',
+    'backup:DeleteBackupVault',
+    'backup:StartBackupJob',
+    'backup:TagResource',
+    'backup:UntagResource',
+    'backup:UpdateBackupPlan',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'ec2:AllocateAddress',
+    'ec2:Associate*',
+    'ec2:Attach*',
+    'ec2:Authorize*',
+    'ec2:Create*',
+    'ec2:Delete*',
+    'ec2:Detach*',
+    'ec2:Disassociate*',
+    'ec2:ImportKeyPair',
+    'ec2:Modify*',
+    'ec2:ReleaseAddress',
+    'ec2:Replace*',
+    'ec2:Revoke*',
+    'ec2:RunInstances',
+    'ec2:StartInstances',
+    'ec2:StopInstances',
+    'ec2:TerminateInstances',
+    'ec2:UpdateSecurityGroupRuleDescriptions*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'kms:CreateAlias',
+    'kms:CreateKey',
+    'kms:DeleteAlias',
+    'kms:TagResource',
+    'kms:UntagResource',
+    'kms:UpdateAlias',
+    'kms:UpdateKeyDescription',
+].sort(compareStrings));
+/** AddPermission, RemovePermission, and InvokeFunction remain in exact
+ * statements so the family allow cannot bypass Lambda resource-policy and
+ * deployment-smoke constraints. */
+exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'lambda:Create*',
+    'lambda:Delete*',
+    'lambda:PublishVersion',
+    'lambda:Put*',
+    'lambda:TagResource',
+    'lambda:UntagResource',
+    'lambda:Update*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS,
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = Object.freeze([
+    'cloudfront:CreateCachePolicy',
+    'cloudfront:CreateDistribution',
+    'cloudfront:CreateFunction',
+    'cloudfront:CreateKeyValueStore',
+    'cloudfront:CreateOriginAccessControl',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = Object.freeze([
+    's3:AbortMultipartUpload',
+    's3:DeleteBucket',
+    's3:DeleteBucketPolicy',
+    's3:DeleteObject',
+    's3:DeleteObjectTagging',
+    's3:DeleteObjectVersion',
+    's3:PutBucket*',
+    's3:PutEncryptionConfiguration',
+    's3:PutLifecycleConfiguration',
+    's3:PutObject',
+    's3:PutObjectTagging',
+    's3:RestoreObject',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = Object.freeze([
+    'wafv2:AssociateWebACL',
+    'wafv2:Create*',
+    'wafv2:Delete*',
+    'wafv2:DisassociateWebACL',
+    'wafv2:TagResource',
+    'wafv2:UntagResource',
+    'wafv2:Update*',
+].sort(compareStrings));
+/** These APIs establish unsupported replicas, global resources, alternate
+ * database topologies, integrations, or cross-Region copies. The generated
+ * architecture does not use them. */
+exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = Object.freeze([
+    'backup:StartCopyJob',
+    'backup:UpdateRegionSettings',
+    'dynamodb:AssociateTableReplica',
+    'dynamodb:CreateGlobalTable',
+    'dynamodb:CreateGlobalTableWitness',
+    'dynamodb:CreateTableReplica',
+    'dynamodb:DeleteGlobalTableWitness',
+    'dynamodb:DeleteTableReplica',
+    'dynamodb:UpdateGlobalTable',
+    'dynamodb:UpdateGlobalTableSettings',
+    'dynamodb:UpdateTableReplicaAutoScaling',
+    'ecr:PutReplicationConfiguration',
+    'kms:ReplicateKey',
+    'kms:UpdatePrimaryRegion',
+    'rds:CopyDBClusterSnapshot',
+    'rds:CopyDBSnapshot',
+    'rds:CreateBlueGreenDeployment',
+    'rds:CreateDBInstanceReadReplica',
+    'rds:CreateDBShardGroup',
+    'rds:CreateGlobalCluster',
+    'rds:CreateIntegration',
+    'rds:CrossRegionCommunication',
+    'rds:DeleteBlueGreenDeployment',
+    'rds:DeleteDBShardGroup',
+    'rds:DeleteGlobalCluster',
+    'rds:DeleteIntegration',
+    'rds:FailoverGlobalCluster',
+    'rds:ModifyDBShardGroup',
+    'rds:ModifyGlobalCluster',
+    'rds:ModifyIntegration',
+    'rds:PromoteReadReplica',
+    'rds:PromoteReadReplicaDBCluster',
+    'rds:RebootDBShardGroup',
+    'rds:RemoveFromGlobalCluster',
+    'rds:StartDBInstanceAutomatedBackupsReplication',
+    'rds:StopDBInstanceAutomatedBackupsReplication',
+    'rds:SwitchoverBlueGreenDeployment',
+    'rds:SwitchoverGlobalCluster',
+    'rds:SwitchoverReadReplica',
+    's3:PutReplicationConfiguration',
+    'secretsmanager:RemoveRegionsFromReplication',
+    'secretsmanager:ReplicateSecretToRegions',
+    'secretsmanager:StopReplicationToReplica',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = Object.freeze([
+    'route53:ChangeResourceRecordSets',
+    'route53:ChangeTagsForResource',
+    'route53:CreateHealthCheck',
+    'route53:DeleteHealthCheck',
+    'route53:UpdateHealthCheck',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = Object.freeze([
+    'cloudfront:DeleteCachePolicy',
+    'cloudfront:DeleteDistribution',
+    'cloudfront:DeleteFunction',
+    'cloudfront:DeleteKeyValueStore',
+    'cloudfront:DeleteOriginAccessControl',
+    'cloudfront:PublishFunction',
+    'cloudfront:TagResource',
+    'cloudfront:UntagResource',
+    'cloudfront:UpdateCachePolicy',
+    'cloudfront:UpdateDistribution',
+    'cloudfront:UpdateFunction',
+    'cloudfront:UpdateKeyValueStore',
+    'cloudfront:UpdateOriginAccessControl',
+    'cloudfront-keyvaluestore:DeleteKey',
+    'cloudfront-keyvaluestore:PutKey',
+    'cloudfront-keyvaluestore:UpdateKeys',
+].sort(compareStrings));
+exports.STAGE_RUNTIME_REGIONAL_ACTIONS = Object.freeze([
+    'appconfig:GetLatestConfiguration',
+    'appconfig:StartConfigurationSession',
+    'cloudwatch:DescribeAlarms',
+    'cloudwatch:PutMetricData',
+    'cognito-idp:CreateUserPoolClient',
+    'cognito-idp:DeleteUserPoolClient',
+    'cognito-idp:DescribeUserPoolClient',
+    'cognito-idp:ListUserPoolClients',
+    'dynamodb:BatchGetItem',
+    'dynamodb:BatchWriteItem',
+    'dynamodb:ConditionCheckItem',
+    'dynamodb:DeleteItem',
+    'dynamodb:DescribeTable',
+    'dynamodb:GetItem',
+    'dynamodb:GetRecords',
+    'dynamodb:GetShardIterator',
+    'dynamodb:PutItem',
+    'dynamodb:Query',
+    'dynamodb:Scan',
+    'dynamodb:TransactWriteItems',
+    'dynamodb:UpdateItem',
+    'ec2:AssignPrivateIpAddresses',
+    'ec2:CreateNetworkInterface',
+    'ec2:DeleteNetworkInterface',
+    'ec2:DescribeNetworkInterfaces',
+    'ec2:DescribeSubnets',
+    'ec2:UnassignPrivateIpAddresses',
+    'ecr:BatchCheckLayerAvailability',
+    'ecr:BatchGetImage',
+    'ecr:GetAuthorizationToken',
+    'ecr:GetDownloadUrlForLayer',
+    'ecs:DescribeTasks',
+    'ecs:RunTask',
+    'ecs:StopTask',
+    'events:DescribeRule',
+    'events:PutEvents',
+    'events:PutRule',
+    'events:PutTargets',
+    'kms:Decrypt',
+    'kms:DescribeKey',
+    'kms:Encrypt',
+    'kms:GenerateDataKey',
+    'lambda:InvokeFunction',
+    'logs:CreateLogDelivery',
+    'logs:CreateLogStream',
+    'logs:DeleteLogDelivery',
+    'logs:DescribeLogGroups',
+    'logs:DescribeResourcePolicies',
+    'logs:GetLogDelivery',
+    'logs:ListLogDeliveries',
+    'logs:PutLogEvents',
+    'logs:PutResourcePolicy',
+    'logs:UpdateLogDelivery',
+    'rds-db:connect',
+    's3:AbortMultipartUpload',
+    's3:DeleteObject',
+    's3:DeleteObjectVersion',
+    's3:GetObject',
+    's3:GetObjectVersion',
+    's3:ListBucket',
+    's3:ListBucketVersions',
+    's3:PutObject',
+    'secretsmanager:DeleteSecret',
+    'secretsmanager:DescribeSecret',
+    'secretsmanager:GetSecretValue',
+    'secretsmanager:PutSecretValue',
+    'secretsmanager:UpdateSecretVersionStage',
+    'sns:Publish',
+    'sqs:ChangeMessageVisibility',
+    'sqs:DeleteMessage',
+    'sqs:GetQueueAttributes',
+    'sqs:GetQueueUrl',
+    'sqs:ReceiveMessage',
+    'sqs:SendMessage',
+    'ssmmessages:CreateControlChannel',
+    'ssmmessages:CreateDataChannel',
+    'ssmmessages:OpenControlChannel',
+    'ssmmessages:OpenDataChannel',
+    'ssm:GetParameter',
+    'ssm:GetParameters',
+    'states:DescribeExecution',
+    'states:SendTaskFailure',
+    'states:SendTaskHeartbeat',
+    'states:SendTaskSuccess',
+    'states:StartExecution',
+].sort(compareStrings));
+exports.STAGE_RUNTIME_GLOBAL_ACTIONS = Object.freeze(['cloudfront:CreateInvalidation'].sort(compareStrings));
+exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = Object.freeze([
+    ...new Set([
+        ...exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS,
+        ...exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS,
+    ]
+        .map((action) => `${action.split(':', 1)[0]}:*`)
+        .filter((family) => !['acm:*', 'cloudwatch:*', 'logs:*'].includes(family))),
+    'cloudwatch:Delete*',
+    'cloudwatch:Disable*',
+    'cloudwatch:Enable*',
+    'cloudwatch:Put*',
+    'cloudwatch:Set*',
+    'cloudwatch:Start*',
+    'cloudwatch:Stop*',
+    'cloudwatch:TagResource',
+    'cloudwatch:UntagResource',
+].sort(compareStrings));
+/** Logs application resources live in the deployment Region, while native WAF
+ * delivery resources live in the CloudFront edge control Region. The allow
+ * statements remain separate; this family exists only to deny mutations in a
+ * third Region. */
+exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = Object.freeze([
+    'logs:Associate*',
+    'logs:Cancel*',
+    'logs:Create*',
+    'logs:Delete*',
+    'logs:Disassociate*',
+    'logs:Put*',
+    'logs:Start*',
+    'logs:Stop*',
+    'logs:Tag*',
+    'logs:Untag*',
+    'logs:Update*',
+].sort(compareStrings));
+exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = Object.freeze([
+    ...new Set(exports.STAGE_RUNTIME_REGIONAL_ACTIONS.map((action) => `${action.split(':', 1)[0]}:*`)),
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = Object.freeze([
+    'AmazonSSMManagedInstanceCore',
+    'service-role/AmazonECSTaskExecutionRolePolicy',
+    'service-role/AWSLambdaBasicDurableExecutionRolePolicy',
+    'service-role/AWSLambdaBasicExecutionRole',
+    'service-role/AWSLambdaVPCAccessExecutionRole',
+]);
+exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = Object.freeze([
+    'iam:AttachRolePolicy',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePolicy',
+].sort(compareStrings));
+const IAM_AUTHORITY_MUTATION_ACTIONS = Object.freeze([
+    'iam:AddRoleToInstanceProfile',
+    'iam:AttachRolePolicy',
+    'iam:CreatePolicyVersion',
+    'iam:DeletePolicy',
+    'iam:DeletePolicyVersion',
+    'iam:DeleteRole',
+    'iam:DeleteRolePermissionsBoundary',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePermissionsBoundary',
+    'iam:PutRolePolicy',
+    'iam:RemoveRoleFromInstanceProfile',
+    'iam:SetDefaultPolicyVersion',
+    'iam:TagPolicy',
+    'iam:TagRole',
+    'iam:UntagPolicy',
+    'iam:UntagRole',
+    'iam:UpdateAssumeRolePolicy',
+    'iam:UpdateRole',
+    'iam:UpdateRoleDescription',
+].sort(compareStrings));
+/** Compact service-family scope guards keep mutation outside the selected AWS
+ * account/Region closed. They intentionally do not claim same-account stage
+ * isolation, because native SST owns account-shared bootstrap resources. */
+exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = Object.freeze([
+    ...new Set([
+        ...exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES,
+        'acm:*',
+        'apigateway:*',
+        'cloudfront:*',
+        'iam:*',
+        'logs:*',
+        'route53:*',
+        's3:*',
+        'wafv2:*',
+    ]),
+].sort(compareStrings));
+/** SST 4.17.1 resolves the generated nonproduction VPC's EC2 NAT image from
+ * this commercial-partition fck-nat publisher. The generated development
+ * bastion reuses that NAT instance, while production uses managed NAT. No
+ * publisher is admitted in partitions where the pinned source is unproven. */
+exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = Object.freeze({
+    aws: Object.freeze(['568608671756']),
+    'aws-cn': Object.freeze([]),
+    'aws-us-gov': Object.freeze([]),
+});
+/** Preserve the generic cross-account guard for ordinary EC2 mutations while
+ * routing RunInstances through its resource-aware statements below. A service
+ * family wildcard would otherwise reject SST's deliberately external AMI. */
+exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = Object.freeze(exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS.filter((action) => action.startsWith('ec2:') && action !== 'ec2:RunInstances'));
+exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES.filter((action) => action !== 'ec2:*'),
+    ...exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS,
+].sort(compareStrings));
+/** A deliberately narrow destructive set for same-account stage defense in
+ * depth. It protects named/tagged production resources without pretending the
+ * deployment roles form a complete IAM boundary. */
+exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = Object.freeze([
+    'backup:Delete*',
+    'budgets:ModifyBudget',
+    'budgets:TagResource',
+    'budgets:UntagResource',
+    'cloudformation:DeleteStack',
+    'cloudformation:UpdateStack',
+    'cloudfront:CreateInvalidation',
+    'cloudfront:Delete*',
+    'cloudfront:PublishFunction',
+    'cloudfront:TagResource',
+    'cloudfront:UntagResource',
+    'cloudfront:Update*',
+    'cognito-idp:Delete*',
+    'dynamodb:Delete*',
+    'ec2:Replace*',
+    'ecr:BatchDeleteImage',
+    'ecr:Delete*',
+    'events:DeleteArchive',
+    'events:DeleteEventBus',
+    'events:DeleteRule',
+    'events:RemoveTargets',
+    'events:UpdateArchive',
+    'events:UpdateEventBus',
+    'iam:Delete*',
+    'kms:ScheduleKeyDeletion',
+    'lambda:Delete*',
+    'rds:Delete*',
+    'rds:ModifyDBCluster',
+    'rds:ModifyDBInstance',
+    'rds:AddSourceIdentifierToSubscription',
+    'rds:RemoveSourceIdentifierFromSubscription',
+    's3:AbortMultipartUpload',
+    's3:CreateBucket',
+    's3:DeleteBucket',
+    's3:DeleteBucketPolicy',
+    's3:DeleteObject*',
+    's3:PutBucket*',
+    's3:PutObject*',
+    's3:RestoreObject',
+    'secretsmanager:DeleteSecret',
+    'servicediscovery:DeleteNamespace',
+    'sqs:DeleteQueue',
+    'ssm:DeleteParameter*',
+    'states:DeleteStateMachine',
+    'wafv2:Delete*',
+    'wafv2:DisassociateWebACL',
+    'wafv2:PutLoggingConfiguration',
+    'wafv2:Update*',
+].sort(compareStrings));
+/** Existing-resource mutations must either retain the exact stage tag or use a
+ * generated stage/SST shared resource identity. Initial create/tag calls are
+ * governed by their request-tag or exact-resource statements instead. */
+exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS.filter((action) => !action.startsWith('cloudfront:') && action !== 's3:CreateBucket'),
+    'cloudfront:DeleteDistribution',
+    'cloudfront:DeleteFunction',
+    'cloudfront:PublishFunction',
+    'cloudfront:UpdateDistribution',
+    'cloudfront:UpdateFunction',
+].sort(compareStrings));
+/** Operations whose target already exposes a stage tag may use the broader
+ * deployer contract. A known different-stage tag must still win as an explicit
+ * deny, including for provider calls that are not destructive by name. */
+exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = Object.freeze([
+    ...new Set([
+        ...exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES,
+        'acm:*',
+        'budgets:*',
+        'cloudformation:*',
+        'cloudfront:*',
+        'iam:*',
+        'logs:*',
+        's3:*',
+        'wafv2:*',
+    ]),
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = Object.freeze(['s3:DeleteBucketPolicy', 's3:PutBucketPolicy'].sort(compareStrings));
+const PRIVILEGE_CONSTRUCTION_ACTIONS = Object.freeze([
+    'account:*',
+    'iam:AttachGroupPolicy',
+    'iam:AttachUserPolicy',
+    'iam:CreateAccessKey',
+    'iam:CreateGroup',
+    'iam:CreateLoginProfile',
+    'iam:CreatePolicy',
+    'iam:CreatePolicyVersion',
+    'iam:CreateUser',
+    'iam:DeleteRolePermissionsBoundary',
+    'iam:PutGroupPolicy',
+    'iam:PutUserPermissionsBoundary',
+    'iam:PutUserPolicy',
+    'iam:SetDefaultPolicyVersion',
+    'organizations:*',
+    'sts:AssumeRole',
+].sort(compareStrings));
+const RUNTIME_PRIVILEGE_ACTIONS = Object.freeze([
+    ...PRIVILEGE_CONSTRUCTION_ACTIONS,
+    'iam:AttachRolePolicy',
+    'iam:CreateInstanceProfile',
+    'iam:CreateRole',
+    'iam:DeleteRole',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePermissionsBoundary',
+    'iam:PutRolePolicy',
+    'iam:UpdateAssumeRolePolicy',
+].sort(compareStrings));
+/** Permission-management actions that the generated lifecycle must call. Each
+ * exception is named exactly here and remains subject to the resource and
+ * condition containment statements below. */
+exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = Object.freeze([
+    'iam:AttachRolePolicy',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePermissionsBoundary',
+    'iam:PutRolePolicy',
+    'kms:CreateGrant',
+    'lambda:AddPermission',
+    'lambda:RemovePermission',
+    'logs:PutResourcePolicy',
+    's3:DeleteBucketPolicy',
+    's3:PutBucketOwnershipControls',
+    's3:PutBucketPolicy',
+    's3:PutBucketPublicAccessBlock',
+    'sns:SetTopicAttributes',
+    'sqs:SetQueueAttributes',
+].sort(compareStrings));
+/** Compact deny patterns covering permission-management actions admitted by
+ * wildcard lifecycle grants but not named as reviewed exceptions. The focused
+ * oracle derives every wildcard service family from the policy and proves each
+ * currently admitted permission-management action is reviewed or denied, and
+ * that no compact pattern also captures a retained read-only action. */
+exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = Object.freeze([
+    'apigateway:*AccessAssociation',
+    'apigateway:*Certificate*Domain',
+    'apigateway:DeletePortalProductSharingPolicy',
+    'apigateway:PutPortalProductSharingPolicy',
+    'apigateway:SetWebACL',
+    'apigateway:Update*Policy',
+    'backup:DeleteBackupVault*Policy',
+    'backup:ListIndexedRecoveryPointsForSearch',
+    'backup:PutBackupVault*Policy',
+    'backup:SearchRecoveryPoint',
+    'cloudfront:AllowVendedLogDeliveryForResource',
+    'dynamodb:DeleteResourcePolicy',
+    'dynamodb:PutResourcePolicy',
+    'dynamodb:UpdateAbacStatus',
+    'ec2:*Appliance*NatGateway',
+    'ec2:*ImageBlockPublicAccess',
+    'ec2:*OdbNetworkPeering',
+    'ec2:*Permission',
+    'ec2:*Resources*PlacementGroup',
+    'ec2:*SnapshotBlockPublicAccess',
+    'ec2:DeleteResourcePolicy',
+    'ec2:ModifySnapshotAttribute',
+    'ec2:ModifyVpcEndpointServicePermissions',
+    'ec2:PutResourcePolicy',
+    'ec2:ResetSnapshotAttribute',
+    'ecr:DeleteRegistryPolicy',
+    'ecr:DeleteRepositoryPolicy',
+    'ecr:PutRegistryPolicy',
+    'ecr:SetRepositoryPolicy',
+    'ecs:AllowVendedLogDeliveryForResource',
+    'elasticloadbalancing:AllowVendedLogDeliveryForResource',
+    'events:*Permission',
+    'kms:PutKeyPolicy',
+    'kms:RetireGrant',
+    'kms:RevokeGrant',
+    'lambda:*LayerVersionPermission',
+    'lambda:*Replication',
+    'lambda:DeleteResourcePolicy',
+    'lambda:PutResourcePolicy',
+    'logs:DeleteResourcePolicy',
+    'rds:AuthorizeDBSecurityGroupIngress',
+    's3:AssociateAccessGrantsIdentityCenter',
+    's3:BypassGovernanceRetention',
+    's3:CreateAccessGrant*',
+    's3:Delete*AccessPointPolicy*',
+    's3:DeleteAccessGrant*',
+    's3:DissociateAccessGrantsIdentityCenter',
+    's3:ObjectOwnerOverrideToBucketOwner',
+    's3:Put*AccessPointPolicy*',
+    's3:Put*Acl',
+    's3:PutAccessGrantsInstanceResourcePolicy',
+    's3:PutAccessPointPublicAccessBlock',
+    's3:PutAccountPublicAccessBlock',
+    's3:UpdateAccessGrantsLocation',
+    'secretsmanager:DeleteResourcePolicy',
+    'secretsmanager:PutResourcePolicy',
+    'secretsmanager:ValidateResourcePolicy',
+    'sns:*Permission',
+    'sqs:*Permission',
+    'ssm:*ResourcePolicy',
+    'ssm:ModifyDocumentPermission',
+    'wafv2:DeletePermissionPolicy',
+    'wafv2:PutPermissionPolicy',
+].sort(compareStrings));
+const ADDITIONAL_RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS = Object.freeze([
+    'ec2:AcceptTransitGatewayPeeringAttachment',
+    'ec2:AcceptVpcPeeringConnection',
+    'ec2:CreateTransitGatewayPeeringAttachment',
+    'ec2:CreateVpcEndpointServiceConfiguration',
+    'ec2:CreateVpcPeeringConnection',
+    'ec2:DeleteVpcEndpointServiceConfigurations',
+    'ec2:ModifyImageAttribute',
+    'ec2:ModifyVpcEndpointServiceConfiguration',
+    'ec2:ModifyVpcPeeringConnectionOptions',
+    'ecr:PutReplicationConfiguration',
+    'iam:UpdateAssumeRolePolicy',
+    'logs:DeleteAccountPolicy',
+    'logs:DeleteDeliveryDestinationPolicy',
+    'logs:PutAccountPolicy',
+    'logs:PutDeliveryDestinationPolicy',
+    'logs:PutDestinationPolicy',
+    'rds:ModifyDBClusterSnapshotAttribute',
+    'rds:ModifyDBSnapshotAttribute',
+    'states:DeleteResourcePolicy',
+    'states:PutResourcePolicy',
+    'states:RevealSecrets',
+    'states:TestState',
+].sort(compareStrings));
+const RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS,
+    ...ADDITIONAL_RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS,
+].sort(compareStrings));
+/** Stable exclusions from the temporary infrastructure-administrator role.
+ * These are account administration, direct application data/user mutation,
+ * message handling, or export paths rather than native stack reconciliation.
+ * The generated deployed smoke retains only its four exact Cognito admin calls. */
+exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = Object.freeze([
+    'acm:*Acme*',
+    'acm:ExportCertificate',
+    'acm:PutAccountConfiguration',
+    'appconfig:UpdateAccountSettings',
+    'cognito-idp:AdminConfirmSignUp',
+    'cognito-idp:AdminDeleteUserAttributes',
+    'cognito-idp:AdminDisable*',
+    'cognito-idp:AdminEnableUser',
+    'cognito-idp:AdminForgetDevice',
+    'cognito-idp:*Auth*',
+    'cognito-idp:*Device*',
+    'cognito-idp:*UserMFA*',
+    'cognito-idp:AdminGetUser',
+    'cognito-idp:AdminLinkProviderForUser',
+    'cognito-idp:AdminList*',
+    'cognito-idp:AdminRemoveUserFromGroup',
+    'cognito-idp:AdminResetUserPassword',
+    'cognito-idp:AdminSetUserSettings',
+    'cognito-idp:AdminUpdateUserAttributes',
+    'cognito-idp:AdminUserGlobalSignOut',
+    'cognito-idp:ChangePassword',
+    'cognito-idp:ConfirmForgotPassword',
+    'cognito-idp:ConfirmSignUp',
+    'cognito-idp:DeleteUser',
+    'cognito-idp:DeleteUserAttributes',
+    'cognito-idp:ForgotPassword',
+    'cognito-idp:GetTokensFromRefreshToken',
+    'cognito-idp:GetUser',
+    'cognito-idp:GetUserAttributeVerificationCode',
+    'cognito-idp:GlobalSignOut',
+    'cognito-idp:ListUsers*',
+    'cognito-idp:ResendConfirmationCode',
+    'cognito-idp:RevokeToken',
+    'cognito-idp:SetUser*',
+    'cognito-idp:SignUp',
+    'cognito-idp:UpdateUserAttributes',
+    'cognito-idp:VerifySoftwareToken',
+    'cognito-idp:VerifyUserAttribute',
+    'dynamodb:*Item*',
+    'dynamodb:ExportTableToPointInTime',
+    'dynamodb:GetRecords',
+    'dynamodb:GetShardIterator',
+    'dynamodb:ImportTable',
+    'dynamodb:PartiQL*',
+    'dynamodb:PurchaseReservedCapacityOfferings',
+    'dynamodb:Query',
+    'dynamodb:ReadDataForReplication',
+    'dynamodb:RestoreTableFrom*',
+    'dynamodb:Scan',
+    'dynamodb:WriteDataForReplication',
+    'ecr:CreatePullThroughCacheRule',
+    'ecr:CreateRepositoryCreationTemplate',
+    'ecr:DeletePullThroughCacheRule',
+    'ecr:DeleteRepositoryCreationTemplate',
+    'ecr:DeleteSigningConfiguration',
+    'ecr:PutAccountSetting',
+    'ecr:PutRegistryScanningConfiguration',
+    'ecr:PutSigningConfiguration',
+    'ecr:UpdatePullThroughCacheRule',
+    'ecr:UpdateRepositoryCreationTemplate',
+    'ecs:DeleteAccountSetting',
+    'ecs:ExecuteCommand',
+    'ecs:PutAccountSetting',
+    'ecs:PutAccountSettingDefault',
+    'ecs:RunTask',
+    'ecs:StartTask',
+    'ecs:StopTask',
+    'logs:CancelExportTask',
+    'logs:CreateExportTask',
+    'rds:CancelExportTask',
+    'rds:ModifyCertificates',
+    'rds:PurchaseReservedDBInstancesOffering',
+    'rds:StartExportTask',
+    'secretsmanager:CancelRotateSecret',
+    'secretsmanager:RotateSecret',
+    'secretsmanager:UpdateSecretVersionStage',
+    'sns:*PhoneNumber*',
+    'sns:*SMS*',
+    'sqs:*Message*',
+    'sqs:PurgeQueue',
+    'ssm:CreateActivation',
+    'ssm:ResumeSession',
+    'ssm:SendCommand',
+    'ssm:StartAutomationExecution',
+    'ssm:StartChangeRequestExecution',
+    'ssm:StartSession',
+    'ssm:TerminateSession',
+].sort(compareStrings));
+const SECRET_BATCH_VALUE_READ_ACTIONS = Object.freeze([
+    'secretsmanager:BatchGetSecretValue',
+]);
+const GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS = Object.freeze([
+    'secretsmanager:GetSecretValue',
+    'secretsmanager:PutSecretValue',
+    'secretsmanager:UpdateSecret',
+].sort(compareStrings));
+const SSM_HISTORY_AND_RECURSIVE_VALUE_READ_ACTIONS = Object.freeze(['ssm:GetParameterHistory', 'ssm:GetParametersByPath'].sort(compareStrings));
+const WORKFLOW_EXECUTION_MUTATION_ACTIONS = Object.freeze([
+    'states:RedriveExecution',
+    'states:StartExecution',
+    'states:StartSyncExecution',
+    'states:StopExecution',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = Object.freeze([
+    'states:RedriveExecution',
+    'states:StartSyncExecution',
+    'states:StopExecution',
+].sort(compareStrings));
+const LAMBDA_INTEGRATION_PRINCIPALS = Object.freeze([
+    'apigateway.amazonaws.com',
+    'cloudfront.amazonaws.com',
+    'events.amazonaws.com',
+].sort(compareStrings));
+const REVIEWED_LAMBDA_PERMISSION_PRINCIPALS = Object.freeze([...LAMBDA_INTEGRATION_PRINCIPALS, '*'].sort(compareStrings));
+exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = Object.freeze([
+    Object.freeze({
+        path: 'ecs.amazonaws.com/AWSServiceRoleForECS',
+        serviceName: 'ecs.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService',
+        serviceName: 'ecs.application-autoscaling.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'rds.amazonaws.com/AWSServiceRoleForRDS',
+        serviceName: 'rds.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster',
+        serviceName: 'rds.application-autoscaling.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'wafv2.amazonaws.com/AWSServiceRoleForWAFV2Logging',
+        serviceName: 'wafv2.amazonaws.com',
+    }),
+]);
+const IAM_POLICY_VERSION = '2012-10-17';
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function githubOidcAudience(partition) {
+    return partition === 'aws-cn' ? 'sts.amazonaws.com.cn' : 'sts.amazonaws.com';
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => compareStrings(left, right))
+        .map(([key, entry]) => [key, canonicalize(entry)]));
+}
+function deepFreeze(value) {
+    if (!value || typeof value !== 'object' || Object.isFrozen(value)) {
+        return value;
+    }
+    for (const entry of Object.values(value))
+        deepFreeze(entry);
+    return Object.freeze(value);
+}
+function policy(statements) {
+    return {
+        Statement: [...statements].sort((left, right) => compareStrings(left.Sid, right.Sid)),
+        Version: IAM_POLICY_VERSION,
+    };
+}
+function omitPolicyStatementSids(document) {
+    const record = document;
+    const statements = record['Statement'];
+    if (!Array.isArray(statements)) {
+        throw new Error('Stage authority template policy statements are invalid.');
+    }
+    return {
+        ...record,
+        Statement: statements.map((entry) => {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+                throw new Error('Stage authority template policy statement is invalid.');
+            }
+            return Object.fromEntries(Object.entries(entry).filter(([key]) => key !== 'Sid'));
+        }),
+    };
+}
+function statement(input) {
+    if ((input.Resource === undefined) === (input.NotResource === undefined)) {
+        throw new Error('Stage authority statements require exactly one Resource or NotResource scope.');
+    }
+    return {
+        ...input,
+        Action: [...input.Action].sort(compareStrings),
+        ...(input.Resource
+            ? { Resource: [...input.Resource].sort(compareStrings) }
+            : {}),
+        ...(input.NotResource
+            ? { NotResource: [...input.NotResource].sort(compareStrings) }
+            : {}),
+    };
+}
+function requireIdentity(input) {
+    const partition = input.partition ?? 'aws';
+    if (!ACCOUNT_ID.test(input.accountId) ||
+        !REGION.test(input.region) ||
+        !exports.STAGE_AUTHORITY_STAGES.includes(input.stage) ||
+        !exports.STAGE_AUTHORITY_PARTITIONS.includes(partition)) {
+        throw new Error('Stage authority requires one exact account, Region, partition, and canonical stage.');
+    }
+    return {
+        accountId: input.accountId,
+        partition,
+        region: input.region,
+        stage: input.stage,
+    };
+}
+function createStageAuthorityIdentity(input) {
+    const identity = requireIdentity(input);
+    const boundaryPath = `/ebk/${identity.stage}/`;
+    const boundaryName = `workload-role-boundary-${identity.stage}`;
+    const deploymentRolePath = `/ebk/${identity.stage}/deployment/`;
+    const deploymentRoleName = `ebk-${identity.stage}-deploy`;
+    const deploymentPolicyNames = Object.freeze([
+        `stage-deployment-read-${identity.stage}`,
+        `stage-deployment-regional-mutation-${identity.stage}`,
+        `stage-deployment-global-iam-mutation-${identity.stage}`,
+        `stage-deployment-global-resource-mutation-${identity.stage}`,
+        `stage-deployment-generated-resource-mutation-${identity.stage}`,
+        `stage-deployment-stage-containment-${identity.stage}`,
+        `stage-deployment-permission-guardrails-${identity.stage}`,
+        `stage-deployment-guardrails-${identity.stage}`,
+    ]);
+    const workloadRolePath = `/ebk/${identity.stage}/workloads/`;
+    const workloadInstanceProfilePath = workloadRolePath;
+    return Object.freeze({
+        boundaryArn: `arn:${identity.partition}:iam::${identity.accountId}:policy${boundaryPath}${boundaryName}`,
+        boundaryName,
+        boundaryPath,
+        deploymentPolicyArns: Object.freeze(deploymentPolicyNames.map((name) => `arn:${identity.partition}:iam::${identity.accountId}:policy${deploymentRolePath}${name}`)),
+        deploymentPolicyNames,
+        deploymentRoleArn: `arn:${identity.partition}:iam::${identity.accountId}:role${deploymentRolePath}${deploymentRoleName}`,
+        deploymentRoleName,
+        deploymentRolePath,
+        stackName: `ebk-${identity.stage}-stage-authority`,
+        workloadInstanceProfileArnPattern: `arn:${identity.partition}:iam::${identity.accountId}:instance-profile${workloadInstanceProfilePath}*`,
+        workloadInstanceProfilePath,
+        workloadRoleArnPattern: `arn:${identity.partition}:iam::${identity.accountId}:role${workloadRolePath}*`,
+        workloadRolePath,
+    });
+}
+function requireTrust(input, identity) {
+    const principals = [...new Set(input.awsPrincipalArns ?? [])].sort(compareStrings);
+    if (principals.length > STAGE_AUTHORITY_MAX_AWS_PRINCIPALS ||
+        principals.some((arn) => {
+            const match = AWS_PRINCIPAL_ARN.exec(arn);
+            return (Buffer.byteLength(arn, 'utf8') >
+                STAGE_AUTHORITY_MAX_AWS_PRINCIPAL_ARN_BYTES ||
+                !match ||
+                match[1] !== identity.partition);
+        })) {
+        throw new Error('Stage authority AWS trust must contain at most 16 bounded unique exact principal ARNs in the selected partition.');
+    }
+    const statements = [];
+    if (principals.length > 0) {
+        statements.push({
+            Action: 'sts:AssumeRole',
+            Effect: 'Allow',
+            Principal: { AWS: principals },
+            Sid: 'AssumeFromReviewedAwsPrincipals',
+        });
+    }
+    if (input.github) {
+        const match = GITHUB_OIDC_PROVIDER_ARN.exec(input.github.oidcProviderArn);
+        const subjectMatch = GITHUB_SUBJECT.exec(input.github.subject);
+        if (!match ||
+            match[1] !== identity.partition ||
+            match[2] !== identity.accountId ||
+            !subjectMatch) {
+            throw new Error('Stage authority GitHub trust must use the target account provider and one immutable environment subject.');
+        }
+        if (subjectMatch[1] !== identity.stage) {
+            throw new Error('Stage authority GitHub trust environment must match the selected stage.');
+        }
+        statements.push({
+            Action: 'sts:AssumeRoleWithWebIdentity',
+            Condition: {
+                StringEquals: {
+                    'token.actions.githubusercontent.com:aud': githubOidcAudience(identity.partition),
+                    'token.actions.githubusercontent.com:sub': input.github.subject,
+                },
+            },
+            Effect: 'Allow',
+            Principal: { Federated: input.github.oidcProviderArn },
+            Sid: 'AssumeFromReviewedGithubEnvironment',
+        });
+    }
+    if (statements.length === 0) {
+        throw new Error('Stage authority requires at least one reviewed AWS or GitHub trust principal.');
+    }
+    return {
+        Statement: statements.sort((left, right) => compareStrings(String(left['Sid']), String(right['Sid']))),
+        Version: IAM_POLICY_VERSION,
+    };
+}
+function runtimeBoundaryPolicy(options) {
+    return policy([
+        statement({
+            Action: exports.STAGE_RUNTIME_REGIONAL_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'AllowFixedRuntimeServicesInStageRegion',
+        }),
+        statement({
+            Action: ['sts:GetCallerIdentity'],
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'AllowRuntimeCallerIdentity',
+        }),
+        statement({
+            Action: exports.STAGE_RUNTIME_GLOBAL_ACTIONS,
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'AllowFixedRuntimeGlobalServices',
+        }),
+        statement({
+            Action: ['iam:PassRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:PassedToService': [
+                        'appconfig.amazonaws.com',
+                        'ec2.amazonaws.com',
+                        'ecs-tasks.amazonaws.com',
+                        'lambda.amazonaws.com',
+                        'states.amazonaws.com',
+                    ].sort(compareStrings),
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'AllowRuntimePassBoundedStageRoles',
+        }),
+        statement({
+            Action: exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES,
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimeOutsideStageRegion',
+        }),
+        statement({
+            Action: ['*'],
+            Condition: {
+                Null: { 'aws:ResourceAccount': 'false' },
+                StringNotEquals: { 'aws:ResourceAccount': options.accountId },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimeCrossAccountResources',
+        }),
+        statement({
+            Action: ['*'],
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'false' },
+                StringNotEquals: { 'aws:ResourceTag/ebk:stage': options.stage },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimeKnownOtherStageResources',
+        }),
+        statement({
+            Action: RUNTIME_PRIVILEGE_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimePrivilegeConstruction',
+        }),
+    ]);
+}
+const SST_4_17_1_PHYSICAL_NAME_RANDOM_SUFFIX_LENGTH = 9;
+const FOUNDATION_ROUTER_CLOUDFRONT_FUNCTION_NAMES = [
+    'FoundationRouterCloudfrontFunctionRequest',
+    'FoundationRouterCloudfrontFunctionResponse',
+];
+function sst4171PhysicalNamePattern(input) {
+    const maximumPrefixLength = input.maximumLength - SST_4_17_1_PHYSICAL_NAME_RANDOM_SUFFIX_LENGTH;
+    const stageLength = input.stage.length;
+    const nameLength = input.logicalName.length;
+    const prefix = nameLength + 1 >= maximumPrefixLength
+        ? input.logicalName.substring(0, maximumPrefixLength)
+        : nameLength + stageLength + 2 >= maximumPrefixLength
+            ? `${input.stage.substring(0, maximumPrefixLength - nameLength - 1)}-${input.logicalName}`
+            : `${input.application.substring(0, maximumPrefixLength - stageLength - nameLength - 2)}-${input.stage}-${input.logicalName}`;
+    return `${prefix}-*`;
+}
+function generatedRouterCloudFrontFunctionResources(options, stage) {
+    return FOUNDATION_ROUTER_CLOUDFRONT_FUNCTION_NAMES.map((logicalName) => `arn:${options.partition}:cloudfront::${options.accountId}:function/${sst4171PhysicalNamePattern({
+        application: 'foundation',
+        logicalName,
+        maximumLength: 64,
+        stage,
+    })}`).sort(compareStrings);
+}
+function deploymentPolicy(options) {
+    const edgeRegion = edgeControlRegion(options.partition, options.region);
+    const managedPolicies = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES.map((name) => `arn:${options.partition}:iam::aws:policy/${name}`);
+    const productionDatabaseResources = [
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:cluster:*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:db:*`,
+    ];
+    const productionRetentionResources = [
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:backup-plan:*`,
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:backup-vault:*`,
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:recovery-point:*`,
+    ];
+    const productionDataExportBucketResources = [
+        `arn:${options.partition}:s3:::ebk-${options.accountId}-production-*-data-export`,
+        `arn:${options.partition}:s3:::ebk-${options.accountId}-production-*-data-export/*`,
+    ];
+    const productionDataExportAliasResources = [
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:alias/ebk-production-*-data-export`,
+    ];
+    const stageLambdaResources = [
+        `arn:${options.partition}:lambda:${options.region}:${options.accountId}:function:*`,
+    ];
+    const foundationNatWorkloadRoleResources = [
+        `arn:${options.partition}:iam::${options.accountId}:role${options.identity.workloadRolePath}ebk-${options.stage}-foundation-nat`,
+    ];
+    const stageCloudFrontDistributionResources = [
+        `arn:${options.partition}:cloudfront::${options.accountId}:distribution/*`,
+    ];
+    const stageRouterWebAclResources = [
+        `arn:${options.partition}:wafv2:${edgeRegion}:${options.accountId}:global/webacl/*-${options.stage}-*/*`,
+    ];
+    const stageRouterCloudFrontFunctionResources = generatedRouterCloudFrontFunctionResources(options, options.stage);
+    const productionRouterCloudFrontFunctionResources = generatedRouterCloudFrontFunctionResources(options, 'production');
+    const stageRouterWafLogDestinationResources = [
+        `arn:${options.partition}:logs:${edgeRegion}:${options.accountId}:log-group:aws-waf-logs-foundation-${options.stage}-FoundationRouter-*`,
+    ];
+    const generatedEdgeLogGroupMutationResources = [
+        ...stageRouterWafLogDestinationResources,
+        ...(options.region === edgeRegion
+            ? [
+                `arn:${options.partition}:logs:${options.region}:${options.accountId}:log-group:/aws/vendedlogs/apis/*-${options.stage}-*`,
+                `arn:${options.partition}:logs:${options.region}:${options.accountId}:log-group:/ebk/${options.stage}/*`,
+            ]
+            : []),
+    ].sort(compareStrings);
+    const productionEventSubscriptionResources = [
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:es:*`,
+    ];
+    const stageAccountBudgetResources = [
+        `arn:${options.partition}:budgets::${options.accountId}:budget/*`,
+    ];
+    const stageTopicResources = [
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:*-${options.stage}-*`,
+    ];
+    const generatedFoundationAlertTopicResources = [
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:foundation-${options.stage}-FoundationAlertsTopic-*`,
+    ];
+    const stageQueueResources = [
+        `arn:${options.partition}:sqs:${options.region}:${options.accountId}:*-${options.stage}-*`,
+    ];
+    const stageReadableSsmValueResources = [
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/ebk/${options.stage}/foundation/*`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/bootstrap`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/passphrase/*/${options.stage}`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/vpc/vpc-*/private-key-value`,
+    ].sort(compareStrings);
+    // SST 4.17.1 models the generated Aurora credential as a managed
+    // SecretVersion. The pinned AWS provider needs PutSecretValue to create it,
+    // GetSecretValue to reconcile its AWSCURRENT version during removal, and may
+    // use UpdateSecret while reconciling its owning Secret resource. Because
+    // UpdateSecret can also carry plaintext, keep all three operations bound to
+    // the one Foundation-owned physical-name and stage-tag contract;
+    // operator/generated paths and every other secret value remain explicitly
+    // outside this exception.
+    const generatedFoundationDatabaseCredentialResources = [
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:foundation-${options.stage}-FoundationDatabaseProxySecret-*`,
+    ];
+    const machineAuthorizationStackResources = [
+        `arn:${options.partition}:cloudformation:${options.region}:${options.accountId}:stack/*MachineAuthorization*/*`,
+    ];
+    const costAnomalyMonitorResources = [
+        `arn:${options.partition}:ce::${options.accountId}:anomalymonitor/*`,
+    ];
+    const costAnomalySubscriptionResources = [
+        `arn:${options.partition}:ce::${options.accountId}:anomalysubscription/*`,
+    ];
+    const costAnomalyResources = [
+        ...costAnomalyMonitorResources,
+        ...costAnomalySubscriptionResources,
+    ].sort(compareStrings);
+    const productionCostScope = '*/account/production';
+    const eventArchiveResources = [
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:archive/ebk-${options.stage}-foundation-events`,
+    ];
+    const foundationEventBusResources = [
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:event-bus/foundation-${options.stage}-FoundationEventBusBus-*`,
+    ];
+    const stageKmsKeyResources = [
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:key/*`,
+    ];
+    const stageKmsAliasResources = [
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:alias/ebk-${options.stage}-*-data-export`,
+    ];
+    const stageStateMachineResources = [
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:stateMachine:*-${options.stage}-*`,
+    ];
+    // Native SST physical state-machine names are derived from Pulumi logical
+    // names and do not necessarily contain the stage. Step Functions exposes the
+    // state machine's resource tags while authorizing both the state machine and
+    // its Standard executions, so the governed execution path uses the exact
+    // account/Region namespace plus the stage tag instead of a name convention.
+    const accountStateMachineResources = [
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:stateMachine:*`,
+    ];
+    const accountExecutionResources = [
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:execution:*:*`,
+    ];
+    const serviceLinkedRoleResources = exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES.map(({ path }) => `arn:${options.partition}:iam::${options.accountId}:role/aws-service-role/${path}`);
+    const stageAndSharedMutationResources = [
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:*:*${options.stage}*`,
+        `arn:${options.partition}:budgets::${options.accountId}:budget/*`,
+        ...stageRouterCloudFrontFunctionResources,
+        `arn:${options.partition}:dynamodb:${options.region}:${options.accountId}:table/*-${options.stage}-*`,
+        `arn:${options.partition}:ecr:${options.region}:${options.accountId}:repository/ebk/${options.stage}/*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:archive/ebk-${options.stage}-*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:event-bus/*-${options.stage}-*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:rule/*-${options.stage}-*`,
+        `arn:${options.partition}:iam::${options.accountId}:instance-profile/ebk/${options.stage}/workloads/*`,
+        `arn:${options.partition}:iam::${options.accountId}:role/ebk/${options.stage}/workloads/*`,
+        ...stageKmsAliasResources,
+        `arn:${options.partition}:lambda:${options.region}:${options.accountId}:function:*-${options.stage}-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:cluster:*-${options.stage}-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:db:*-${options.stage}-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:snapshot:*-${options.stage}-*`,
+        `arn:${options.partition}:s3:::*-${options.stage}-*`,
+        `arn:${options.partition}:s3:::*-${options.stage}-*/*`,
+        `arn:${options.partition}:s3:::sst-asset-*`,
+        `arn:${options.partition}:s3:::sst-asset-*/*`,
+        `arn:${options.partition}:s3:::sst-state-*`,
+        `arn:${options.partition}:s3:::sst-state-*/*`,
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:ebk/${options.stage}/*`,
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:*-${options.stage}-*`,
+        `arn:${options.partition}:sqs:${options.region}:${options.accountId}:*-${options.stage}-*`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/*${options.stage}*`,
+        ...stageStateMachineResources,
+        `arn:${options.partition}:wafv2:${edgeRegion}:${options.accountId}:global/webacl/*-${options.stage}-*/*`,
+    ].sort(compareStrings);
+    const namedProductionResources = [
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:backup-vault:*production*`,
+        `arn:${options.partition}:cloudwatch:${options.region}:${options.accountId}:alarm:*production*`,
+        `arn:${options.partition}:cloudwatch::${options.accountId}:dashboard/*production*`,
+        ...productionRouterCloudFrontFunctionResources,
+        `arn:${options.partition}:dynamodb:${options.region}:${options.accountId}:table/*-production-*`,
+        `arn:${options.partition}:ecr:${options.region}:${options.accountId}:repository/ebk/production/*`,
+        `arn:${options.partition}:ecs:${options.region}:${options.accountId}:cluster/*production*`,
+        `arn:${options.partition}:ecs:${options.region}:${options.accountId}:service/*production*/*`,
+        `arn:${options.partition}:elasticloadbalancing:${options.region}:${options.accountId}:loadbalancer/*/*production*/*`,
+        `arn:${options.partition}:elasticloadbalancing:${options.region}:${options.accountId}:targetgroup/*production*/*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:event-bus/*-production-*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:rule/*-production-*`,
+        `arn:${options.partition}:iam::${options.accountId}:instance-profile/ebk/production/*`,
+        `arn:${options.partition}:iam::${options.accountId}:policy/ebk/production/*`,
+        `arn:${options.partition}:iam::${options.accountId}:role/ebk/production/*`,
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:alias/ebk-production-*-data-export`,
+        `arn:${options.partition}:lambda:${options.region}:${options.accountId}:function:*-production-*`,
+        `arn:${options.partition}:logs:${options.region}:${options.accountId}:log-group:*production*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:cluster:*-production-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:db:*-production-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:snapshot:*-production-*`,
+        `arn:${options.partition}:s3:::*-production-*`,
+        `arn:${options.partition}:s3:::*-production-*/*`,
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:ebk/production/*`,
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:*-production-*`,
+        `arn:${options.partition}:sqs:${options.region}:${options.accountId}:*-production-*`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/*production*`,
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:stateMachine:*-production-*`,
+        `arn:${options.partition}:wafv2:${edgeRegion}:${options.accountId}:global/webacl/*-production-*/*`,
+    ].sort(compareStrings);
+    const stageAndSharedSstBucketResources = [
+        `arn:${options.partition}:s3:::*-${options.stage}-*`,
+        `arn:${options.partition}:s3:::sst-asset-*`,
+        `arn:${options.partition}:s3:::sst-state-*`,
+    ].sort(compareStrings);
+    const runInstancesExternalReferenceResources = [
+        `arn:${options.partition}:ec2:${options.region}::image/ami-*`,
+        `arn:${options.partition}:ec2:${options.region}::snapshot/snap-*`,
+    ].sort(compareStrings);
+    const runInstancesApprovedReferenceOwners = [
+        options.accountId,
+        ...(options.stage === 'production'
+            ? []
+            : exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION[options.partition]),
+    ].sort(compareStrings);
+    const statements = [
+        statement({
+            Action: exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadFixedRegionalServiceFamilies',
+        }),
+        statement({
+            Action: ['acm:Describe*', 'acm:Get*', 'acm:List*'],
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadEdgeCertificateControlPlane',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadEdgeObservabilityControlPlane',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: stageRouterWafLogDestinationResources,
+            Sid: 'ManageOnlyGeneratedEdgeWafLogGroup',
+        }),
+        // CloudWatch Logs models these native WAF delivery calls as account-level
+        // operations. PutResourcePolicy exposes neither a resource ARN nor an
+        // action-specific condition key; reviewed generated source is the control
+        // for its uninspectable payload, and the request remains edge-Region-bound.
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ManageEdgeWafLogDeliveryControlPlane',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS,
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadFixedGlobalServiceFamilies',
+        }),
+        statement({
+            Action: ['states:DescribeExecution'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: accountExecutionResources,
+            Sid: 'DescribeOnlyTaggedStageWorkflowExecutions',
+        }),
+        statement({
+            Action: ['states:DescribeExecution'],
+            Condition: {
+                StringNotEquals: {
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Deny',
+            Resource: accountExecutionResources,
+            Sid: 'DenyWorkflowExecutionReadWithoutStageTag',
+        }),
+        statement({
+            Action: ['states:DescribeExecution'],
+            Effect: 'Deny',
+            NotResource: accountExecutionResources,
+            Sid: 'DenyWorkflowExecutionReadOutsideAccount',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+                StringEqualsIfExists: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                    'aws:ResourceAccount': options.accountId,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateFixedRegionalServiceFamilies',
+        }),
+        statement({
+            Action: ['acm:*'],
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+                StringEqualsIfExists: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                    'aws:ResourceAccount': options.accountId,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateEdgeCertificates',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateStageBucketsInStageRegion',
+        }),
+        statement({
+            Action: ['s3:CreateBucket'],
+            Condition: options.region === 'us-east-1'
+                ? {
+                    Null: { 's3:LocationConstraint': 'true' },
+                    StringEquals: { 'aws:RequestedRegion': options.region },
+                }
+                : {
+                    StringEquals: {
+                        'aws:RequestedRegion': options.region,
+                        's3:LocationConstraint': options.region,
+                    },
+                },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateBucketOnlyInStageRegion',
+        }),
+        // The generated architecture does not synthesize a stable Grant resource
+        // whose grantee and operation set can be enumerated here. Follow AWS KMS's
+        // integrated-service contract instead: a user cannot call CreateGrant
+        // directly, and the grant remains bound to this account's stage key.
+        statement({
+            Action: ['kms:CreateGrant'],
+            Condition: {
+                Bool: { 'kms:GrantIsForAWSResource': 'true' },
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+                StringEqualsIfExists: {
+                    'aws:ResourceAccount': options.accountId,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageKmsKeyResources,
+            Sid: 'CreateOnlyAwsResourceKmsGrants',
+        }),
+        statement({
+            Action: ['ec2:RunInstances'],
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'LaunchStageInfrastructureFromApprovedReferences',
+        }),
+        statement({
+            Action: SECRET_BATCH_VALUE_READ_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenySecretsManagerBatchValueReads',
+        }),
+        statement({
+            Action: GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS,
+            Effect: 'Deny',
+            NotResource: generatedFoundationDatabaseCredentialResources,
+            Sid: 'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
+        }),
+        statement({
+            Action: GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS,
+            Condition: {
+                StringNotEquals: {
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Deny',
+            Resource: generatedFoundationDatabaseCredentialResources,
+            Sid: 'DenyGeneratedDatabaseValueAccessWithWrongStageTag',
+        }),
+        statement({
+            Action: ['ssm:GetParameter', 'ssm:GetParameters'],
+            Effect: 'Deny',
+            NotResource: stageReadableSsmValueResources,
+            Sid: 'DenyUnapprovedSsmValueReads',
+        }),
+        statement({
+            Action: SSM_HISTORY_AND_RECURSIVE_VALUE_READ_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenySsmHistoryAndRecursiveValueReads',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonDeploymentControlOperations',
+        }),
+        statement({
+            Action: WORKFLOW_EXECUTION_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            NotResource: [
+                ...accountExecutionResources,
+                ...accountStateMachineResources,
+            ],
+            Sid: 'DenyUnscopedWorkflowExecutionMutation',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnsupportedWorkflowExecutionMutation',
+        }),
+        statement({
+            Action: ['states:StartExecution'],
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            Resource: accountStateMachineResources,
+            Sid: 'DenyUntaggedWorkflowExecutionStart',
+        }),
+        statement({
+            Action: ['states:StartExecution'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: accountStateMachineResources,
+            Sid: 'StartOnlyTaggedStageWorkflowExecutions',
+        }),
+        statement({
+            Action: ['cloudformation:CreateStack'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: machineAuthorizationStackResources,
+            Sid: 'CreateTaggedMachineAuthorizationStacks',
+        }),
+        statement({
+            Action: ['cloudformation:DeleteStack', 'cloudformation:UpdateStack'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: machineAuthorizationStackResources,
+            Sid: 'MutateTaggedMachineAuthorizationStacks',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: eventArchiveResources,
+            Sid: 'CreateNamedFoundationEventArchive',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: foundationEventBusResources,
+            Sid: 'CreateArchiveFromTaggedFoundationEventBus',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: eventArchiveResources,
+            Sid: 'MutateNamedFoundationEventArchive',
+        }),
+        statement({
+            Action: [
+                ...exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS,
+                ...exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS,
+            ],
+            Effect: 'Deny',
+            NotResource: [...eventArchiveResources, ...foundationEventBusResources],
+            Sid: 'DenyEventArchiveMutationOutsideGeneratedFoundationArchive',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageKmsKeyResources,
+            Sid: 'EnableRotationOnStageKmsKeys',
+        }),
+        statement({
+            Action: ['iam:CreateServiceLinkedRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:AWSServiceName': exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES.map(({ serviceName }) => serviceName),
+                },
+            },
+            Effect: 'Allow',
+            Resource: serviceLinkedRoleResources,
+            Sid: 'CreateOnlyRequiredServiceLinkedRoles',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateOnlyGeneratedCloudFrontResources',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS,
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateFixedGlobalServiceFamilies',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateCloudFrontScopeWafInEdgeRegion',
+        }),
+        statement({
+            Action: ['route53:CreateHostedZone'],
+            Condition: {
+                Bool: { 'aws:ViaAWSService': 'true' },
+                StringEquals: {
+                    'aws:CalledViaLast': 'servicediscovery.amazonaws.com',
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateOnlyCloudMapPrivateHostedZones',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: [
+                `arn:${options.partition}:cloudfront::${options.accountId}:*/*`,
+            ],
+            Sid: 'MutateAccountCloudFront',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': edgeRegion,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageCloudFrontDistributionResources,
+            Sid: 'InvalidateOnlyStageCloudFrontDistributions',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'InvokeOnlyStageLambdaFunctions',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'lambda:Principal': LAMBDA_INTEGRATION_PRINCIPALS,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'AddOnlyReviewedStageLambdaIntegrations',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'lambda:FunctionUrlAuthType': 'NONE',
+                    'lambda:Principal': '*',
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'AddOnlyPublicStageLambdaFunctionUrlAccess',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                // AddPermission accepts InvokedViaFunctionUrl, but Lambda does not
+                // expose that request member as a caller-side authorization context.
+                // The companion request is distinguishable from the public
+                // InvokeFunctionUrl permission by the absence of FunctionUrlAuthType.
+                Null: {
+                    'lambda:FunctionUrlAuthType': 'true',
+                },
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'lambda:Principal': '*',
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'AddOnlyPublicStageLambdaFunctionUrlInvoke',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS,
+            Condition: {
+                ArnLike: {
+                    'wafv2:LogDestinationResource': stageRouterWafLogDestinationResources,
+                },
+                StringEquals: {
+                    'aws:RequestedRegion': edgeRegion,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'wafv2:LogScope': 'CUSTOMER',
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageRouterWebAclResources,
+            Sid: 'PutOnlyStageRouterWafLogging',
+        }),
+        statement({
+            Action: ['budgets:ModifyBudget', 'budgets:TagResource'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageAccountBudgetResources,
+            Sid: 'CreateOnlyTaggedStageAccountBudget',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageAccountBudgetResources,
+            Sid: 'MutateOnlyTaggedStageAccountBudget',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            Resource: productionEventSubscriptionResources,
+            Sid: 'DenyUnscopedDatabaseEventSubscriptionSourceMutation',
+        }),
+        statement({
+            Action: ['lambda:RemovePermission'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'RemoveOnlyStageLambdaIntegrations',
+        }),
+        statement({
+            Action: ['lambda:AddPermission', 'lambda:RemovePermission'],
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnscopedLambdaPermissions',
+        }),
+        statement({
+            Action: ['sns:SetTopicAttributes'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageTopicResources,
+            Sid: 'SetOnlyStageTopicAttributes',
+        }),
+        // RDS validates that the CreateEventSubscription caller can publish to
+        // its destination topic. The regional service-family allow admits that
+        // control-plane check; this exact deny keeps every other topic closed.
+        // Runtime workloads retain their separately generated least-privilege roles.
+        statement({
+            Action: ['sns:Publish'],
+            Effect: 'Deny',
+            NotResource: generatedFoundationAlertTopicResources,
+            Sid: 'DenyPublishOutsideGeneratedFoundationAlerts',
+        }),
+        statement({
+            Action: ['sqs:SetQueueAttributes'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageQueueResources,
+            Sid: 'SetOnlyStageQueueAttributes',
+        }),
+        statement({
+            Action: ['sns:SetTopicAttributes'],
+            Effect: 'Deny',
+            NotResource: stageTopicResources,
+            Sid: 'DenyTopicAttributeMutationOutsideStage',
+        }),
+        statement({
+            Action: ['sqs:SetQueueAttributes'],
+            Effect: 'Deny',
+            NotResource: stageQueueResources,
+            Sid: 'DenyQueueAttributeMutationOutsideStage',
+        }),
+        statement({
+            Action: [
+                'iam:AddRoleToInstanceProfile',
+                'iam:CreateInstanceProfile',
+                'iam:DeleteInstanceProfile',
+                'iam:DeleteRole',
+                'iam:DeleteRolePolicy',
+                'iam:PutRolePolicy',
+                'iam:RemoveRoleFromInstanceProfile',
+                'iam:TagInstanceProfile',
+                'iam:TagRole',
+                'iam:UntagInstanceProfile',
+                'iam:UntagRole',
+                'iam:UpdateRole',
+                'iam:UpdateRoleDescription',
+            ],
+            Effect: 'Allow',
+            Resource: [
+                options.identity.workloadInstanceProfileArnPattern,
+                options.identity.workloadRoleArnPattern,
+            ],
+            Sid: 'ManageStageWorkloadIdentities',
+        }),
+        statement({
+            Action: ['iam:CreateRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'CreateOnlyBoundaryConstrainedStageWorkloadRoles',
+        }),
+        statement({
+            Action: ['iam:PutRolePermissionsBoundary'],
+            Condition: {
+                StringEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'ApplyExactStageRuntimeBoundary',
+        }),
+        statement({
+            Action: ['iam:AttachRolePolicy', 'iam:DetachRolePolicy'],
+            Condition: {
+                ArnEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                    'iam:PolicyARN': managedPolicies,
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'AttachOnlyPinnedAwsRuntimePolicies',
+        }),
+        statement({
+            Action: ['iam:PassRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:PassedToService': [
+                        'appconfig.amazonaws.com',
+                        'ec2.amazonaws.com',
+                        'ecs-tasks.amazonaws.com',
+                        'lambda.amazonaws.com',
+                        'states.amazonaws.com',
+                    ].sort(compareStrings),
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'PassOnlyStageWorkloadRoles',
+        }),
+        statement({
+            Action: ['iam:PassRole'],
+            Condition: {
+                StringNotEquals: {
+                    'iam:PassedToService': 'ec2.amazonaws.com',
+                },
+            },
+            Effect: 'Deny',
+            Resource: foundationNatWorkloadRoleResources,
+            Sid: 'DenyFoundationNatRolePassOutsideEc2',
+        }),
+        statement({
+            Action: PRIVILEGE_CONSTRUCTION_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyAccountAndPrivilegeAdministration',
+        }),
+        statement({
+            Action: RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnreviewableResourcePolicyAndTrustExpansion',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnsupportedReplicationAndTopology',
+        }),
+        statement({
+            Action: [
+                'servicediscovery:CreateHttpNamespace',
+                'servicediscovery:CreatePublicDnsNamespace',
+            ],
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonPrivateServiceDiscoveryNamespaces',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            NotResource: stageAndSharedSstBucketResources,
+            Sid: 'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                StringNotEquals: {
+                    'lambda:Principal': REVIEWED_LAMBDA_PERMISSION_PRINCIPALS,
+                },
+            },
+            Effect: 'Deny',
+            Resource: stageLambdaResources,
+            Sid: 'DenyUnreviewedLambdaIntegrationPrincipal',
+        }),
+        statement({
+            Action: ['budgets:UntagResource'],
+            Condition: {
+                'ForAnyValue:StringEquals': {
+                    'aws:TagKeys': 'ebk:stage',
+                },
+            },
+            Effect: 'Deny',
+            Resource: stageAccountBudgetResources,
+            Sid: 'DenyStageAccountBudgetStageTagRemoval',
+        }),
+        statement({
+            Action: IAM_AUTHORITY_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            Resource: [
+                options.identity.boundaryArn,
+                ...options.identity.deploymentPolicyArns,
+                options.identity.deploymentRoleArn,
+            ],
+            Sid: 'DenyStageAuthorityMutation',
+        }),
+        statement({
+            Action: ['iam:DeleteRolePermissionsBoundary'],
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyRuntimeBoundaryRemoval',
+        }),
+        statement({
+            Action: ['iam:UpdateAssumeRolePolicy'],
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyRuntimeTrustPolicyMutation',
+        }),
+        statement({
+            Action: ['iam:PutRolePermissionsBoundary'],
+            Condition: {
+                ArnNotEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyRuntimeBoundarySubstitution',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS,
+            Condition: {
+                ArnNotEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyUnboundedStageWorkloadIdentityPolicyMutation',
+        }),
+        statement({
+            Action: ['iam:AttachRolePolicy'],
+            Condition: {
+                ArnNotEquals: { 'iam:PolicyARN': managedPolicies },
+            },
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyUnapprovedManagedPolicyAttachment',
+        }),
+        statement({
+            Action: ['acm:*'],
+            Condition: {
+                StringNotEquals: {
+                    'aws:RequestedRegion': [options.region, edgeRegion],
+                },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyAcmMutationOutsideStageAndEdgeRegions',
+        }),
+        statement({
+            Action: [
+                ...exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS,
+                's3:CreateBucket',
+            ],
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyS3MutationOutsideStageRegion',
+        }),
+        statement({
+            Action: [
+                ...exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS,
+                ...exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS,
+                ...exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS,
+                ...exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS,
+                ...exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS,
+                ...exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS,
+            ],
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyEdgeControlMutationOutsideEdgeRegion',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES,
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyMutationOutsideStageRegion',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES,
+            Condition: {
+                StringNotEquals: {
+                    'aws:RequestedRegion': [options.region, edgeRegion],
+                },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyLogsMutationOutsideStageAndEdgeRegions',
+        }),
+        // When the application and CloudFront edge control planes share a Region,
+        // RequestedRegion cannot distinguish their log groups. In that case admit
+        // only the generated application and API execution-log namespaces so both
+        // create-time and existing-resource lifecycle calls remain bounded.
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Deny',
+            NotResource: generatedEdgeLogGroupMutationResources,
+            Sid: 'DenyEdgeLogGroupMutationOutsideGeneratedStageLogs',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceAccount': 'false' },
+                StringNotEquals: { 'aws:ResourceAccount': options.accountId },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyCrossAccountMutationWhenResourceAccountIsKnown',
+        }),
+        statement({
+            Action: ['ec2:RunInstances'],
+            Condition: {
+                Null: { 'aws:ResourceAccount': 'false' },
+                StringNotEquals: { 'aws:ResourceAccount': options.accountId },
+            },
+            Effect: 'Deny',
+            NotResource: runInstancesExternalReferenceResources,
+            Sid: 'DenyCrossAccountRunInstancesTargets',
+        }),
+        statement({
+            Action: ['ec2:RunInstances'],
+            Condition: {
+                StringNotEquals: {
+                    'ec2:Owner': runInstancesApprovedReferenceOwners,
+                },
+            },
+            Effect: 'Deny',
+            Resource: runInstancesExternalReferenceResources,
+            Sid: 'DenyRunInstancesFromUnapprovedReferenceOwners',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'false' },
+                StringNotEquals: { 'aws:ResourceTag/ebk:stage': options.stage },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyKnownOtherStageResourceMutation',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            NotResource: stageAndSharedMutationResources,
+            Sid: 'DenyUntaggedMutationOutsideStageAndSstResources',
+        }),
+        statement({
+            Action: ['*'],
+            Condition: {
+                Null: { 'aws:RequestTag/ebk:stage': 'false' },
+                StringNotEquals: { 'aws:RequestTag/ebk:stage': options.stage },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyExplicitOtherStageRequestTag',
+        }),
+    ];
+    if (options.stage !== 'production') {
+        statements.push(statement({
+            Action: ['kms:ScheduleKeyDeletion'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:management': 'standard-data-export',
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageKmsKeyResources,
+            Sid: 'RetireOnlyTaggedNonProductionKmsKeys',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:ResourceTag/ebk:stage': 'production' },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonProductionAccessToProductionTaggedResources',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            Resource: namedProductionResources,
+            Sid: 'DenyNonProductionAccessToNamedProductionResources',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonProductionDatabaseEventSubscriptionSourceMutation',
+        }));
+    }
+    if (options.stage === 'production') {
+        statements.push(statement({
+            Action: ['kms:ScheduleKeyDeletion'],
+            Effect: 'Deny',
+            Resource: stageKmsKeyResources,
+            Sid: 'DenyProtectedProductionKmsKeyDeletion',
+        }), statement({
+            Action: ['kms:DeleteAlias'],
+            Effect: 'Deny',
+            Resource: productionDataExportAliasResources,
+            Sid: 'DenyProtectedProductionDataExportAliasDeletion',
+        }), statement({
+            Action: [
+                's3:DeleteBucket',
+                's3:DeleteBucketPolicy',
+                's3:DeleteObject',
+                's3:DeleteObjectVersion',
+            ],
+            Effect: 'Deny',
+            Resource: productionDataExportBucketResources,
+            Sid: 'DenyProtectedProductionDataExportDeletion',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': 'production',
+                },
+            },
+            Effect: 'Allow',
+            Resource: productionEventSubscriptionResources,
+            Sid: 'MutateOnlyProductionDatabaseEventSubscriptionSources',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS,
+            Condition: {
+                StringLike: {
+                    'aws:ResourceTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Allow',
+            Resource: costAnomalyResources,
+            Sid: 'ReadProductionCostAnomalyControl',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                },
+                StringLike: {
+                    'aws:RequestTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateProductionCostAnomalyControl',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS,
+            Condition: {
+                StringLike: {
+                    'aws:ResourceTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Allow',
+            Resource: costAnomalyResources,
+            Sid: 'MutateProductionCostAnomalyControl',
+        }), statement({
+            Action: ['ce:TagResource'],
+            Condition: {
+                Null: { 'aws:RequestTag/ebk:cost-scope': 'false' },
+                StringNotLike: {
+                    'aws:RequestTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Deny',
+            Resource: costAnomalyResources,
+            Sid: 'DenyProductionCostScopeSubstitution',
+        }), statement({
+            Action: ['ce:UntagResource'],
+            Condition: {
+                'ForAnyValue:StringEquals': {
+                    'aws:TagKeys': 'ebk:cost-scope',
+                },
+            },
+            Effect: 'Deny',
+            Resource: costAnomalyResources,
+            Sid: 'DenyProductionCostScopeRemoval',
+        }), statement({
+            Action: [
+                'backup:DeleteRecoveryPoint',
+                'rds:DeleteDBCluster',
+                'rds:DeleteDBClusterAutomatedBackup',
+                'rds:DeleteDBInstance',
+                'rds:DeleteDBSnapshot',
+            ],
+            Effect: 'Deny',
+            Resource: productionDatabaseResources,
+            Sid: 'DenyProtectedProductionDatabaseDeletion',
+        }), statement({
+            Action: [
+                'backup:DeleteBackupPlan',
+                'backup:DeleteBackupSelection',
+                'backup:DeleteBackupVault',
+                'backup:DeleteRecoveryPoint',
+            ],
+            Effect: 'Deny',
+            Resource: productionRetentionResources,
+            Sid: 'DenyProtectedProductionRetentionDeletion',
+        }));
+    }
+    const groups = [
+        {
+            kind: 'read',
+            logicalId: 'StageDeploymentReadPolicy',
+            sids: [
+                'DenyGeneratedDatabaseValueAccessWithWrongStageTag',
+                'DenyNonPrivateServiceDiscoveryNamespaces',
+                'DenyRuntimeBoundaryRemoval',
+                'DenySecretsManagerBatchValueReads',
+                'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
+                'DenySsmHistoryAndRecursiveValueReads',
+                'DenyWorkflowExecutionReadOutsideAccount',
+                'DenyUnapprovedSsmValueReads',
+                'CreateOnlyAwsResourceKmsGrants',
+                'ManageEdgeWafLogDeliveryControlPlane',
+                'ManageOnlyGeneratedEdgeWafLogGroup',
+                'PutOnlyStageRouterWafLogging',
+                'ReadFixedGlobalServiceFamilies',
+                'ReadFixedRegionalServiceFamilies',
+                'DenyWorkflowExecutionReadWithoutStageTag',
+                'DescribeOnlyTaggedStageWorkflowExecutions',
+                ...(options.stage === 'production'
+                    ? ['ReadProductionCostAnomalyControl']
+                    : []),
+            ],
+        },
+        {
+            kind: 'regional-mutation',
+            logicalId: 'StageDeploymentRegionalMutationPolicy',
+            sids: [
+                'CreateOnlyCloudMapPrivateHostedZones',
+                'CreateBucketOnlyInStageRegion',
+                'DenyAcmMutationOutsideStageAndEdgeRegions',
+                'DenyEdgeControlMutationOutsideEdgeRegion',
+                'DenyMutationOutsideStageRegion',
+                'DenyS3MutationOutsideStageRegion',
+                'DenyUnscopedWorkflowExecutionMutation',
+                'InvokeOnlyStageLambdaFunctions',
+                'MutateEdgeCertificates',
+                'MutateFixedRegionalServiceFamilies',
+                'MutateStageBucketsInStageRegion',
+            ],
+        },
+        {
+            kind: 'global-iam-mutation',
+            logicalId: 'StageDeploymentGlobalIamMutationPolicy',
+            sids: [
+                'AddOnlyReviewedStageLambdaIntegrations',
+                'ApplyExactStageRuntimeBoundary',
+                'AttachOnlyPinnedAwsRuntimePolicies',
+                'CreateOnlyBoundaryConstrainedStageWorkloadRoles',
+                'DenyFoundationNatRolePassOutsideEc2',
+                'DenyQueueAttributeMutationOutsideStage',
+                'DenyStageAuthorityMutation',
+                'DenyTopicAttributeMutationOutsideStage',
+                'DenyUnscopedLambdaPermissions',
+                'ManageStageWorkloadIdentities',
+                'PassOnlyStageWorkloadRoles',
+                'RemoveOnlyStageLambdaIntegrations',
+                'SetOnlyStageQueueAttributes',
+                'SetOnlyStageTopicAttributes',
+            ],
+        },
+        {
+            kind: 'global-resource-mutation',
+            logicalId: 'StageDeploymentGlobalResourceMutationPolicy',
+            sids: [
+                'DenyCrossAccountMutationWhenResourceAccountIsKnown',
+                'DenyCrossAccountRunInstancesTargets',
+                'DenyLogsMutationOutsideStageAndEdgeRegions',
+                'DenyRunInstancesFromUnapprovedReferenceOwners',
+                'DenyUnsupportedReplicationAndTopology',
+                'LaunchStageInfrastructureFromApprovedReferences',
+                'MutateAccountCloudFront',
+                'MutateCloudFrontScopeWafInEdgeRegion',
+                'MutateFixedGlobalServiceFamilies',
+                'CreateOnlyTaggedStageAccountBudget',
+                'DenyStageAccountBudgetStageTagRemoval',
+                'MutateOnlyTaggedStageAccountBudget',
+            ],
+        },
+        {
+            kind: 'generated-resource-mutation',
+            logicalId: 'StageDeploymentGeneratedResourceMutationPolicy',
+            sids: [
+                'AddOnlyPublicStageLambdaFunctionUrlAccess',
+                'AddOnlyPublicStageLambdaFunctionUrlInvoke',
+                'CreateOnlyRequiredServiceLinkedRoles',
+                'CreateArchiveFromTaggedFoundationEventBus',
+                'CreateNamedFoundationEventArchive',
+                'CreateTaggedMachineAuthorizationStacks',
+                'DenyPublishOutsideGeneratedFoundationAlerts',
+                'EnableRotationOnStageKmsKeys',
+                'InvalidateOnlyStageCloudFrontDistributions',
+                'MutateNamedFoundationEventArchive',
+                'MutateTaggedMachineAuthorizationStacks',
+                ...(options.stage !== 'production'
+                    ? ['RetireOnlyTaggedNonProductionKmsKeys']
+                    : []),
+                'DenyUntaggedWorkflowExecutionStart',
+                'StartOnlyTaggedStageWorkflowExecutions',
+                ...(options.stage === 'production'
+                    ? [
+                        'CreateProductionCostAnomalyControl',
+                        'DenyProductionCostScopeRemoval',
+                        'DenyProductionCostScopeSubstitution',
+                        'MutateOnlyProductionDatabaseEventSubscriptionSources',
+                        'MutateProductionCostAnomalyControl',
+                    ]
+                    : []),
+            ],
+        },
+        {
+            kind: 'stage-containment',
+            logicalId: 'StageDeploymentStageContainmentPolicy',
+            sids: [
+                'CreateOnlyGeneratedCloudFrontResources',
+                'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
+                'DenyEventArchiveMutationOutsideGeneratedFoundationArchive',
+                'DenyExplicitOtherStageRequestTag',
+                'DenyKnownOtherStageResourceMutation',
+                ...(options.stage !== 'production'
+                    ? ['DenyNonProductionDatabaseEventSubscriptionSourceMutation']
+                    : []),
+                'DenyRuntimeTrustPolicyMutation',
+                'DenyUnscopedDatabaseEventSubscriptionSourceMutation',
+                'DenyUntaggedMutationOutsideStageAndSstResources',
+            ],
+        },
+        {
+            kind: 'permission-guardrails',
+            logicalId: 'StageDeploymentPermissionGuardrailsPolicy',
+            sids: [
+                'DenyNonDeploymentControlOperations',
+                'DenyUnboundedStageWorkloadIdentityPolicyMutation',
+                'DenyUnsupportedWorkflowExecutionMutation',
+                'DenyUnreviewableResourcePolicyAndTrustExpansion',
+            ],
+        },
+        {
+            kind: 'guardrails',
+            logicalId: 'StageDeploymentGuardrailsPolicy',
+            sids: [
+                ...statements
+                    .filter((entry) => entry.Sid.startsWith('Deny') &&
+                    ![
+                        'DenyCrossAccountMutationWhenResourceAccountIsKnown',
+                        'DenyCrossAccountRunInstancesTargets',
+                        'DenyEdgeControlMutationOutsideEdgeRegion',
+                        'DenyAcmMutationOutsideStageAndEdgeRegions',
+                        'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
+                        'DenyEventArchiveMutationOutsideGeneratedFoundationArchive',
+                        'DenyExplicitOtherStageRequestTag',
+                        'DenyFoundationNatRolePassOutsideEc2',
+                        'DenyGeneratedDatabaseValueAccessWithWrongStageTag',
+                        'DenyKnownOtherStageResourceMutation',
+                        'DenyLogsMutationOutsideStageAndEdgeRegions',
+                        'DenyMutationOutsideStageRegion',
+                        'DenyNonDeploymentControlOperations',
+                        'DenyNonPrivateServiceDiscoveryNamespaces',
+                        'DenyNonProductionDatabaseEventSubscriptionSourceMutation',
+                        'DenyProductionCostScopeRemoval',
+                        'DenyProductionCostScopeSubstitution',
+                        'DenyPublishOutsideGeneratedFoundationAlerts',
+                        'DenyQueueAttributeMutationOutsideStage',
+                        'DenyRuntimeBoundaryRemoval',
+                        'DenyRuntimeTrustPolicyMutation',
+                        'DenySecretsManagerBatchValueReads',
+                        'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
+                        'DenySsmHistoryAndRecursiveValueReads',
+                        'DenyStageAccountBudgetStageTagRemoval',
+                        'DenyStageAuthorityMutation',
+                        'DenyTopicAttributeMutationOutsideStage',
+                        'DenyUnapprovedSsmValueReads',
+                        'DenyUnreviewableResourcePolicyAndTrustExpansion',
+                        'DenyUnscopedDatabaseEventSubscriptionSourceMutation',
+                        'DenyUnscopedLambdaPermissions',
+                        'DenyUnboundedStageWorkloadIdentityPolicyMutation',
+                        'DenyUnscopedWorkflowExecutionMutation',
+                        'DenyUnsupportedWorkflowExecutionMutation',
+                        'DenyUntaggedWorkflowExecutionStart',
+                        'DenyUntaggedMutationOutsideStageAndSstResources',
+                        'DenyWorkflowExecutionReadWithoutStageTag',
+                        'DenyWorkflowExecutionReadOutsideAccount',
+                        'DenyRunInstancesFromUnapprovedReferenceOwners',
+                        'DenyUnsupportedReplicationAndTopology',
+                        'DenyS3MutationOutsideStageRegion',
+                    ].includes(entry.Sid))
+                    .map((entry) => entry.Sid),
+                'ReadEdgeCertificateControlPlane',
+                'ReadEdgeObservabilityControlPlane',
+            ],
+        },
+    ];
+    const assigned = new Set(groups.flatMap((group) => group.sids));
+    const assignmentCount = groups.reduce((total, group) => total + group.sids.length, 0);
+    const unassigned = statements.filter((entry) => !assigned.has(entry.Sid));
+    if (unassigned.length > 0 ||
+        assigned.size !== statements.length ||
+        assignmentCount !== statements.length) {
+        throw new Error(`Stage authority policy groups must assign every statement exactly once; unassigned: ${unassigned.map((entry) => entry.Sid).join(', ') ||
+            'duplicate assignment'}.`);
+    }
+    return Object.freeze(groups.map((group, index) => {
+        const document = policy(statements.filter((entry) => group.sids.includes(entry.Sid)));
+        const characters = JSON.stringify(omitPolicyStatementSids(document)).length;
+        if (characters >
+            exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT -
+                exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM) {
+            throw new Error(`Stage authority ${group.kind} policy has ${characters} characters; it must retain ${exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM} characters below the IAM managed-policy limit of ${exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT}.`);
+        }
+        const name = options.identity.deploymentPolicyNames[index];
+        const arn = options.identity.deploymentPolicyArns[index];
+        if (!name || !arn) {
+            throw new Error(`Stage authority ${group.kind} identity is incomplete.`);
+        }
+        return Object.freeze({
+            arn,
+            document,
+            kind: group.kind,
+            logicalId: group.logicalId,
+            name,
+        });
+    }));
+}
+function canonicalStageAuthorityTemplate(template) {
+    return `${JSON.stringify(canonicalize(template))}\n`;
+}
+function digestStageAuthorityTemplate(template) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(canonicalStageAuthorityTemplate(template), 'utf8')
+        .digest('hex');
+}
+function createStageAuthorityPlan(input) {
+    const target = requireIdentity(input);
+    const identity = createStageAuthorityIdentity(target);
+    const assumeRolePolicy = requireTrust(input, target);
+    const boundary = runtimeBoundaryPolicy({
+        accountId: target.accountId,
+        identity,
+        region: target.region,
+        stage: target.stage,
+    });
+    const boundaryCharacters = JSON.stringify(omitPolicyStatementSids(boundary)).length;
+    if (boundaryCharacters > exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT) {
+        throw new Error(`Stage runtime boundary has ${boundaryCharacters} characters; the IAM managed-policy limit is ${exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT}.`);
+    }
+    const deployment = deploymentPolicy({
+        accountId: target.accountId,
+        identity,
+        partition: target.partition,
+        region: target.region,
+        stage: target.stage,
+    });
+    const deploymentPolicyResources = Object.fromEntries(deployment.map((entry) => [
+        entry.logicalId,
+        {
+            Properties: {
+                Description: `Stable reviewed ${target.stage} ${entry.kind} deployment authority.`,
+                ManagedPolicyName: entry.name,
+                Path: identity.deploymentRolePath,
+                // IAM statement Sids are diagnostic labels, not authority. Keep them
+                // in the executable policy model while omitting them from the direct
+                // CloudFormation body so every supported partition retains bounded
+                // TemplateBody headroom without changing effective permissions.
+                PolicyDocument: omitPolicyStatementSids(entry.document),
+                Roles: [{ Ref: 'StageDeploymentRole' }],
+            },
+            Type: 'AWS::IAM::ManagedPolicy',
+        },
+    ]));
+    const template = {
+        AWSTemplateFormatVersion: '2010-09-09',
+        Description: `Stable Empire Builder Kit ${target.stage} deployment authority. ` +
+            'This stack changes only when the reviewed stage authority contract changes.',
+        Outputs: {
+            DeploymentRoleArn: { Value: identity.deploymentRoleArn },
+            RuntimeBoundaryArn: { Value: identity.boundaryArn },
+        },
+        Resources: {
+            ...deploymentPolicyResources,
+            StageDeploymentRole: {
+                Properties: {
+                    AssumeRolePolicyDocument: omitPolicyStatementSids(assumeRolePolicy),
+                    Description: `Stable Empire Builder Kit ${target.stage} deployment role.`,
+                    MaxSessionDuration: 3_600,
+                    Path: identity.deploymentRolePath,
+                    RoleName: identity.deploymentRoleName,
+                    Tags: [
+                        { Key: 'ebk:managed-by', Value: 'empire-builder-kit' },
+                        { Key: 'ebk:stage', Value: target.stage },
+                    ],
+                },
+                Type: 'AWS::IAM::Role',
+            },
+            StageRuntimeBoundary: {
+                Properties: {
+                    Description: `Stable maximum permissions for ${target.stage} workload roles.`,
+                    ManagedPolicyName: identity.boundaryName,
+                    Path: identity.boundaryPath,
+                    PolicyDocument: omitPolicyStatementSids(boundary),
+                },
+                Type: 'AWS::IAM::ManagedPolicy',
+            },
+        },
+    };
+    const templateBytes = Buffer.byteLength(canonicalStageAuthorityTemplate(template), 'utf8');
+    if (templateBytes > exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT) {
+        throw new Error(`Stage authority template has ${templateBytes} bytes; the direct CloudFormation TemplateBody limit is ${exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT}.`);
+    }
+    return deepFreeze({
+        deploymentPolicies: deployment,
+        digest: digestStageAuthorityTemplate(template),
+        identity,
+        limitations: Object.freeze({
+            protectedDatabaseConfiguration: 'iam-cannot-inspect-rds-modify-request-fields-lifecycle-preflight-required',
+            resourcePolicyAttributes: 'sns-and-sqs-set-attributes-can-write-resource-policies-name-account-region-containment-applies',
+            sameAccountStageDeploymentIsolation: 'deployment-role-is-account-scoped-use-production-isolated-for-hard-production-boundary',
+            wafLoggingResourcePolicy: 'cloudwatch-logs-put-resource-policy-has-no-resource-or-action-condition-keys-reviewed-generated-source-is-control',
+            workloadTrust: 'iam-cannot-inspect-create-role-trust-reviewed-generated-source-is-control',
+        }),
+        runtimeBoundaryPolicy: boundary,
+        schemaVersion: exports.STAGE_AUTHORITY_SCHEMA_VERSION,
+        template,
+    });
+}
+function createStageIamBoundaryTransformContract(input) {
+    const identity = createStageAuthorityIdentity({
+        ...input,
+        region: 'us-east-1',
+    });
+    return Object.freeze({
+        boundaryArn: identity.boundaryArn,
+        instanceProfilePath: identity.workloadInstanceProfilePath,
+        rolePath: identity.workloadRolePath,
+    });
+}
+function requireTransformArgs(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} transform arguments must be an object.`);
+    }
+    return value;
+}
+function refuseSubstitution(existing, expected, label) {
+    if (existing !== undefined && existing !== expected) {
+        throw new Error(`${label} attempted to substitute stable stage authority.`);
+    }
+}
+/**
+ * Installs ordinary Pulumi resource transforms before generated SST components
+ * are constructed. SST remains responsible for creating its roles and NAT
+ * instance profiles; this helper contributes only the stable stage path and
+ * permissions boundary.
+ */
+function installStageIamBoundaryTransforms(input) {
+    if (typeof input.registerTransform !== 'function' ||
+        input.roleResource === undefined ||
+        input.instanceProfileResource === undefined) {
+        throw new Error('Stage IAM boundary transforms require the ordinary Pulumi role and instance-profile resource types.');
+    }
+    const contract = createStageIamBoundaryTransformContract(input);
+    input.registerTransform(input.roleResource, (value) => {
+        const args = requireTransformArgs(value, 'IAM role');
+        refuseSubstitution(args.permissionsBoundary, contract.boundaryArn, 'IAM role permissions boundary');
+        refuseSubstitution(args.path, contract.rolePath, 'IAM role path');
+        args.permissionsBoundary = contract.boundaryArn;
+        args.path = contract.rolePath;
+    });
+    input.registerTransform(input.instanceProfileResource, (value) => {
+        const args = requireTransformArgs(value, 'IAM instance profile');
+        refuseSubstitution(args.path, contract.instanceProfilePath, 'IAM instance-profile path');
+        args.path = contract.instanceProfilePath;
+    });
+    return contract;
+}
+//# sourceMappingURL=stage-authority.js.map