@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/aws-authority/stage-authority.js

@@ -0,0 +1,2968 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = exports.STAGE_RUNTIME_GLOBAL_ACTIONS = exports.STAGE_RUNTIME_REGIONAL_ACTIONS = exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = exports.STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = exports.STAGE_AUTHORITY_PARTITIONS = exports.STAGE_AUTHORITY_STAGES = exports.STAGE_AUTHORITY_SCHEMA_VERSION = void 0;
+exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = void 0;
+exports.createStageAuthorityIdentity = createStageAuthorityIdentity;
+exports.canonicalStageAuthorityTemplate = canonicalStageAuthorityTemplate;
+exports.digestStageAuthorityTemplate = digestStageAuthorityTemplate;
+exports.assertBoundStageAuthorityTemplateFitsBodyLimit = assertBoundStageAuthorityTemplateFitsBodyLimit;
+exports.createStageAuthorityPlan = createStageAuthorityPlan;
+exports.createStageIamBoundaryTransformContract = createStageIamBoundaryTransformContract;
+exports.installStageIamBoundaryTransforms = installStageIamBoundaryTransforms;
+const node_crypto_1 = require("node:crypto");
+exports.STAGE_AUTHORITY_SCHEMA_VERSION = 1;
+exports.STAGE_AUTHORITY_STAGES = [
+    'development',
+    'staging',
+    'production',
+];
+exports.STAGE_AUTHORITY_PARTITIONS = [
+    'aws',
+    'aws-cn',
+    'aws-us-gov',
+];
+exports.STAGE_AUTHORITY_DEPLOYMENT_POLICY_KINDS = [
+    'read',
+    'regional-mutation',
+    'global-iam-mutation',
+    'global-resource-mutation',
+    'generated-resource-mutation',
+    'stage-containment',
+    'permission-guardrails',
+    'guardrails',
+];
+exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT = 6_144;
+exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM = 200;
+exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT = 51_200;
+exports.STAGE_AUTHORITY_BOUND_TEMPLATE_BODY_MINIMUM_HEADROOM = 1_024;
+const STAGE_AUTHORITY_MAX_AWS_PRINCIPALS = 16;
+const STAGE_AUTHORITY_MAX_AWS_PRINCIPAL_ARN_BYTES = 2_048;
+const ACCOUNT_ID = /^\d{12}$/u;
+const REGION = /^(?:(?:af|ap|ca|cn|eu|il|me|mx|sa|us)(?:-(?:gov|iso|isob|isoe|isof))?|eusc-[a-z]{2})-[a-z]+-\d$/u;
+const AWS_PRINCIPAL_ARN = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):role\/[A-Za-z0-9+=,.@_/-]+$/u;
+const GITHUB_OIDC_PROVIDER_ARN = /^arn:(aws|aws-cn|aws-us-gov):iam::(\d{12}):oidc-provider\/token[.]actions[.]githubusercontent[.]com$/u;
+const GITHUB_SUBJECT = /^repo:[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}\/[A-Za-z0-9_.-]+@[1-9][0-9]{0,19}:environment:(development|staging|production)$/u;
+/** Native lifecycle required by the generated machine-authorization nested
+ * stack. Recovery-only and stack-policy mutation APIs remain ungranted. */
+exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS = Object.freeze([
+    'cloudformation:CreateStack',
+    'cloudformation:DeleteStack',
+    'cloudformation:UpdateStack',
+].sort(compareStrings));
+/** EventBridge archives expose no request-tag or resource-tag IAM condition
+ * keys. Their lifecycle is contained by the exact canonical archive ARN and
+ * requested Region instead. */
+exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS = Object.freeze([
+    'events:CreateArchive',
+]);
+exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS = Object.freeze(['events:DeleteArchive', 'events:UpdateArchive'].sort(compareStrings));
+exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS = Object.freeze([
+    'lambda:InvokeFunction',
+]);
+exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS = Object.freeze([
+    'cloudfront:CreateInvalidation',
+]);
+exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS = Object.freeze([
+    'wafv2:PutLoggingConfiguration',
+]);
+/** SST's CloudFront-scope WAF logging component owns exactly one generated log
+ * group in the edge control Region. These resource-capable actions stay bound
+ * to that generated ARN below. */
+exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS = Object.freeze([
+    'logs:CreateLogGroup',
+    'logs:DeleteLogGroup',
+    'logs:DeleteRetentionPolicy',
+    'logs:PutRetentionPolicy',
+    'logs:TagLogGroup',
+    'logs:TagResource',
+    'logs:UntagLogGroup',
+    'logs:UntagResource',
+].sort(compareStrings));
+/** CloudWatch Logs exposes these WAF delivery mutations only at account scope.
+ * In particular, PutResourcePolicy supports neither resource ARNs nor
+ * action-specific condition keys. Requested Region and reviewed generated
+ * source are therefore the strongest honest controls for that one exception. */
+exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS = Object.freeze([
+    'logs:CreateLogDelivery',
+    'logs:DeleteLogDelivery',
+    'logs:PutResourcePolicy',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS = Object.freeze(['budgets:ModifyBudget', 'budgets:TagResource', 'budgets:UntagResource'].sort(compareStrings));
+exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS = Object.freeze([
+    'rds:AddSourceIdentifierToSubscription',
+    'rds:RemoveSourceIdentifierFromSubscription',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS = Object.freeze([
+    'kms:EnableKeyRotation',
+]);
+/** Commercial AWS exposes CloudFront, CloudFront-scope WAF, and edge
+ * certificates through us-east-1 even when the application stage is deployed
+ * elsewhere. This batch intentionally preserves the selected Region for
+ * nonstandard partitions; CloudFront is not available inside GovCloud. */
+function edgeControlRegion(partition, deploymentRegion) {
+    return partition === 'aws' ? 'us-east-1' : deploymentRegion;
+}
+/** Cost Explorer creation is account-global, while existing anomaly controls
+ * support account-bound ARNs. These exact verbs are admitted only to the
+ * production stage role below. */
+exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS = Object.freeze([
+    'ce:GetAnomalyMonitors',
+    'ce:GetAnomalySubscriptions',
+    'ce:ListTagsForResource',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS = Object.freeze(['ce:CreateAnomalyMonitor', 'ce:CreateAnomalySubscription'].sort(compareStrings));
+exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS = Object.freeze([
+    'ce:DeleteAnomalyMonitor',
+    'ce:DeleteAnomalySubscription',
+    'ce:TagResource',
+    'ce:UntagResource',
+    'ce:UpdateAnomalyMonitor',
+    'ce:UpdateAnomalySubscription',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_COST_ANOMALY_WRITE_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS,
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS = Object.freeze([
+    'access-analyzer:Get*',
+    'access-analyzer:List*',
+    'acm:Describe*',
+    'acm:Get*',
+    'acm:List*',
+    'application-autoscaling:Describe*',
+    'appconfig:Get*',
+    'appconfig:List*',
+    'backup:Describe*',
+    'backup:Get*',
+    'backup:List*',
+    'cloudformation:Describe*',
+    'cloudformation:Get*',
+    'cloudformation:List*',
+    'cloudformation:ValidateTemplate',
+    'cloudwatch:Describe*',
+    'cloudwatch:Get*',
+    'cloudwatch:List*',
+    'cognito-idp:Describe*',
+    'cognito-idp:Get*',
+    'cognito-idp:List*',
+    'dynamodb:Describe*',
+    'dynamodb:Get*',
+    'dynamodb:List*',
+    'ec2:Describe*',
+    'ec2:GetInstanceUefiData',
+    'ec2:GetResourcePolicy',
+    'ecr:Describe*',
+    'ecr:Get*',
+    'ecr:List*',
+    'ecs:Describe*',
+    'ecs:List*',
+    'elasticloadbalancing:Describe*',
+    'events:Describe*',
+    'events:List*',
+    'kms:Describe*',
+    'kms:Get*',
+    'kms:List*',
+    'lambda:Get*',
+    'lambda:List*',
+    'logs:Describe*',
+    'logs:FilterLogEvents',
+    'logs:Get*',
+    'logs:List*',
+    'rds:Describe*',
+    'rds:List*',
+    'secretsmanager:Describe*',
+    'secretsmanager:Get*',
+    'secretsmanager:List*',
+    'servicequotas:Get*',
+    'servicequotas:List*',
+    'servicediscovery:Get*',
+    'servicediscovery:List*',
+    'sns:Get*',
+    'sns:List*',
+    'sqs:Get*',
+    'sqs:List*',
+    'ssm:Describe*',
+    'ssm:Get*',
+    'ssm:List*',
+    'states:Describe*',
+    'states:List*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS = Object.freeze([
+    'apigateway:GET',
+    'budgets:Describe*',
+    'budgets:List*',
+    'budgets:ViewBudget',
+    'cloudfront-keyvaluestore:DescribeKeyValueStore',
+    'cloudfront-keyvaluestore:GetKey',
+    'cloudfront-keyvaluestore:ListKeys',
+    'cloudfront:Describe*',
+    'cloudfront:Get*',
+    'cloudfront:List*',
+    'iam:Get*',
+    'iam:List*',
+    'route53:Get*',
+    'route53:List*',
+    's3:Get*',
+    's3:List*',
+    'sts:GetCallerIdentity',
+    'tag:GetResources',
+    'wafv2:Get*',
+    'wafv2:List*',
+].sort(compareStrings));
+/** CloudFront-scope WAF publishes its observability signals through the edge
+ * control Region. Keep this read surface exact instead of broadening every
+ * regional read when the application Region differs from us-east-1. */
+exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS = Object.freeze([
+    'cloudwatch:GetMetricData',
+    'logs:DescribeLogGroups',
+    'logs:DescribeResourcePolicies',
+].sort(compareStrings));
+/** A deployment role is a temporary infrastructure administrator, not a
+ * runtime workload identity. Routine regional services therefore use one
+ * stable service-family contract instead of a provider-call inventory. The
+ * families whose policy, protection, launch, or trust semantics need tighter
+ * treatment remain on the bounded action sets below. */
+exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS = Object.freeze([
+    'acm:*',
+    'apigateway:*',
+    'appconfig:*',
+    'application-autoscaling:*',
+    'cloudwatch:*',
+    'cognito-idp:*',
+    'dynamodb:*',
+    'ecr:*',
+    'ecs:*',
+    'elasticloadbalancing:*',
+    'events:*',
+    'logs:*',
+    'rds:*',
+    'secretsmanager:*',
+    'servicediscovery:*',
+    'sns:*',
+    'sqs:*',
+    'ssm:*',
+    'states:*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'backup:CreateBackupPlan',
+    'backup:CreateBackupSelection',
+    'backup:CreateBackupVault',
+    'backup:DeleteBackupPlan',
+    'backup:DeleteBackupSelection',
+    'backup:DeleteBackupVault',
+    'backup:StartBackupJob',
+    'backup:TagResource',
+    'backup:UntagResource',
+    'backup:UpdateBackupPlan',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'ec2:AllocateAddress',
+    'ec2:Associate*',
+    'ec2:Attach*',
+    'ec2:Authorize*',
+    'ec2:Create*',
+    'ec2:Delete*',
+    'ec2:Detach*',
+    'ec2:Disassociate*',
+    'ec2:ImportKeyPair',
+    'ec2:Modify*',
+    'ec2:ReleaseAddress',
+    'ec2:Replace*',
+    'ec2:Revoke*',
+    'ec2:RunInstances',
+    'ec2:StartInstances',
+    'ec2:StopInstances',
+    'ec2:TerminateInstances',
+    'ec2:UpdateSecurityGroupRuleDescriptions*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'kms:CreateAlias',
+    'kms:CreateKey',
+    'kms:DeleteAlias',
+    'kms:TagResource',
+    'kms:UntagResource',
+    'kms:UpdateAlias',
+    'kms:UpdateKeyDescription',
+].sort(compareStrings));
+/** AddPermission, RemovePermission, and InvokeFunction remain in exact
+ * statements so the family allow cannot bypass Lambda resource-policy and
+ * deployment-smoke constraints. */
+exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS = Object.freeze([
+    'lambda:Create*',
+    'lambda:Delete*',
+    'lambda:PublishVersion',
+    'lambda:Put*',
+    'lambda:TagResource',
+    'lambda:UntagResource',
+    'lambda:Update*',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_BACKUP_INFRASTRUCTURE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_BROAD_REGIONAL_SERVICE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_EC2_INFRASTRUCTURE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_KMS_INFRASTRUCTURE_ACTIONS,
+    ...exports.STAGE_AUTHORITY_LAMBDA_INFRASTRUCTURE_ACTIONS,
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS = Object.freeze([
+    'cloudfront:CreateCachePolicy',
+    'cloudfront:CreateDistribution',
+    'cloudfront:CreateFunction',
+    'cloudfront:CreateKeyValueStore',
+    'cloudfront:CreateOriginAccessControl',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS = Object.freeze([
+    's3:AbortMultipartUpload',
+    's3:DeleteBucket',
+    's3:DeleteBucketPolicy',
+    's3:DeleteObject',
+    's3:DeleteObjectTagging',
+    's3:DeleteObjectVersion',
+    's3:PutBucket*',
+    's3:PutEncryptionConfiguration',
+    's3:PutLifecycleConfiguration',
+    's3:PutObject',
+    's3:PutObjectTagging',
+    's3:RestoreObject',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS = Object.freeze([
+    'wafv2:AssociateWebACL',
+    'wafv2:Create*',
+    'wafv2:Delete*',
+    'wafv2:DisassociateWebACL',
+    'wafv2:TagResource',
+    'wafv2:UntagResource',
+    'wafv2:Update*',
+].sort(compareStrings));
+/** These APIs establish unsupported replicas, global resources, alternate
+ * database topologies, integrations, or cross-Region copies. The generated
+ * architecture does not use them. */
+exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS = Object.freeze([
+    'backup:StartCopyJob',
+    'backup:UpdateRegionSettings',
+    'dynamodb:AssociateTableReplica',
+    'dynamodb:CreateGlobalTable',
+    'dynamodb:CreateGlobalTableWitness',
+    'dynamodb:CreateTableReplica',
+    'dynamodb:DeleteGlobalTableWitness',
+    'dynamodb:DeleteTableReplica',
+    'dynamodb:UpdateGlobalTable',
+    'dynamodb:UpdateGlobalTableSettings',
+    'dynamodb:UpdateTableReplicaAutoScaling',
+    'ecr:PutReplicationConfiguration',
+    'kms:ReplicateKey',
+    'kms:UpdatePrimaryRegion',
+    'rds:CopyDBClusterSnapshot',
+    'rds:CopyDBSnapshot',
+    'rds:CreateBlueGreenDeployment',
+    'rds:CreateDBInstanceReadReplica',
+    'rds:CreateDBShardGroup',
+    'rds:CreateGlobalCluster',
+    'rds:CreateIntegration',
+    'rds:CrossRegionCommunication',
+    'rds:DeleteBlueGreenDeployment',
+    'rds:DeleteDBShardGroup',
+    'rds:DeleteGlobalCluster',
+    'rds:DeleteIntegration',
+    'rds:FailoverGlobalCluster',
+    'rds:ModifyDBShardGroup',
+    'rds:ModifyGlobalCluster',
+    'rds:ModifyIntegration',
+    'rds:PromoteReadReplica',
+    'rds:PromoteReadReplicaDBCluster',
+    'rds:RebootDBShardGroup',
+    'rds:RemoveFromGlobalCluster',
+    'rds:StartDBInstanceAutomatedBackupsReplication',
+    'rds:StopDBInstanceAutomatedBackupsReplication',
+    'rds:SwitchoverBlueGreenDeployment',
+    'rds:SwitchoverGlobalCluster',
+    'rds:SwitchoverReadReplica',
+    's3:PutReplicationConfiguration',
+    'secretsmanager:RemoveRegionsFromReplication',
+    'secretsmanager:ReplicateSecretToRegions',
+    'secretsmanager:StopReplicationToReplica',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS = Object.freeze([
+    'route53:ChangeResourceRecordSets',
+    'route53:ChangeTagsForResource',
+    'route53:CreateHealthCheck',
+    'route53:DeleteHealthCheck',
+    'route53:UpdateHealthCheck',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS = Object.freeze([
+    'cloudfront:DeleteCachePolicy',
+    'cloudfront:DeleteDistribution',
+    'cloudfront:DeleteFunction',
+    'cloudfront:DeleteKeyValueStore',
+    'cloudfront:DeleteOriginAccessControl',
+    'cloudfront:PublishFunction',
+    'cloudfront:TagResource',
+    'cloudfront:UntagResource',
+    'cloudfront:UpdateCachePolicy',
+    'cloudfront:UpdateDistribution',
+    'cloudfront:UpdateFunction',
+    'cloudfront:UpdateKeyValueStore',
+    'cloudfront:UpdateOriginAccessControl',
+    'cloudfront-keyvaluestore:DeleteKey',
+    'cloudfront-keyvaluestore:PutKey',
+    'cloudfront-keyvaluestore:UpdateKeys',
+].sort(compareStrings));
+exports.STAGE_RUNTIME_REGIONAL_ACTIONS = Object.freeze([
+    'appconfig:GetLatestConfiguration',
+    'appconfig:StartConfigurationSession',
+    'cloudwatch:DescribeAlarms',
+    'cloudwatch:PutMetricData',
+    'cognito-idp:CreateUserPoolClient',
+    'cognito-idp:DeleteUserPoolClient',
+    'cognito-idp:DescribeUserPoolClient',
+    'cognito-idp:ListUserPoolClients',
+    'dynamodb:BatchGetItem',
+    'dynamodb:BatchWriteItem',
+    'dynamodb:ConditionCheckItem',
+    'dynamodb:DeleteItem',
+    'dynamodb:DescribeTable',
+    'dynamodb:GetItem',
+    'dynamodb:GetRecords',
+    'dynamodb:GetShardIterator',
+    'dynamodb:PutItem',
+    'dynamodb:Query',
+    'dynamodb:Scan',
+    'dynamodb:TransactWriteItems',
+    'dynamodb:UpdateItem',
+    'ec2:AssignPrivateIpAddresses',
+    'ec2:CreateNetworkInterface',
+    'ec2:DeleteNetworkInterface',
+    'ec2:DescribeNetworkInterfaces',
+    'ec2:DescribeSubnets',
+    'ec2:UnassignPrivateIpAddresses',
+    'ecr:BatchCheckLayerAvailability',
+    'ecr:BatchGetImage',
+    'ecr:GetAuthorizationToken',
+    'ecr:GetDownloadUrlForLayer',
+    'ecs:DescribeTasks',
+    'ecs:RunTask',
+    'ecs:StopTask',
+    'events:DescribeRule',
+    'events:PutEvents',
+    'events:PutRule',
+    'events:PutTargets',
+    'kms:Decrypt',
+    'kms:DescribeKey',
+    'kms:Encrypt',
+    'kms:GenerateDataKey',
+    'lambda:InvokeFunction',
+    'logs:CreateLogDelivery',
+    'logs:CreateLogStream',
+    'logs:DeleteLogDelivery',
+    'logs:DescribeLogGroups',
+    'logs:DescribeResourcePolicies',
+    'logs:GetLogDelivery',
+    'logs:ListLogDeliveries',
+    'logs:PutLogEvents',
+    'logs:PutResourcePolicy',
+    'logs:UpdateLogDelivery',
+    'rds-db:connect',
+    's3:AbortMultipartUpload',
+    's3:DeleteObject',
+    's3:DeleteObjectVersion',
+    's3:GetObject',
+    's3:GetObjectVersion',
+    's3:ListBucket',
+    's3:ListBucketVersions',
+    's3:PutObject',
+    'secretsmanager:DeleteSecret',
+    'secretsmanager:DescribeSecret',
+    'secretsmanager:GetSecretValue',
+    'secretsmanager:PutSecretValue',
+    'secretsmanager:UpdateSecretVersionStage',
+    'sns:Publish',
+    'sqs:ChangeMessageVisibility',
+    'sqs:DeleteMessage',
+    'sqs:GetQueueAttributes',
+    'sqs:GetQueueUrl',
+    'sqs:ReceiveMessage',
+    'sqs:SendMessage',
+    'ssmmessages:CreateControlChannel',
+    'ssmmessages:CreateDataChannel',
+    'ssmmessages:OpenControlChannel',
+    'ssmmessages:OpenDataChannel',
+    'ssm:GetParameter',
+    'ssm:GetParameters',
+    'states:DescribeExecution',
+    'states:SendTaskFailure',
+    'states:SendTaskHeartbeat',
+    'states:SendTaskSuccess',
+    'states:StartExecution',
+].sort(compareStrings));
+exports.STAGE_RUNTIME_GLOBAL_ACTIONS = Object.freeze(['cloudfront:CreateInvalidation'].sort(compareStrings));
+exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES = Object.freeze([
+    ...new Set([
+        ...exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS,
+        ...exports.STAGE_AUTHORITY_CLOUDFORMATION_LIFECYCLE_ACTIONS,
+    ]
+        .map((action) => `${action.split(':', 1)[0]}:*`)
+        .filter((family) => !['acm:*', 'cloudwatch:*', 'logs:*'].includes(family))),
+    'cloudwatch:Delete*',
+    'cloudwatch:Disable*',
+    'cloudwatch:Enable*',
+    'cloudwatch:Put*',
+    'cloudwatch:Set*',
+    'cloudwatch:Start*',
+    'cloudwatch:Stop*',
+    'cloudwatch:TagResource',
+    'cloudwatch:UntagResource',
+].sort(compareStrings));
+/** Logs application resources live in the deployment Region, while native WAF
+ * delivery resources live in the CloudFront edge control Region. The allow
+ * statements remain separate; this family exists only to deny mutations in a
+ * third Region. */
+exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES = Object.freeze([
+    'logs:Associate*',
+    'logs:Cancel*',
+    'logs:Create*',
+    'logs:Delete*',
+    'logs:Disassociate*',
+    'logs:Put*',
+    'logs:Start*',
+    'logs:Stop*',
+    'logs:Tag*',
+    'logs:Untag*',
+    'logs:Update*',
+].sort(compareStrings));
+exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES = Object.freeze([
+    ...new Set(exports.STAGE_RUNTIME_REGIONAL_ACTIONS.map((action) => `${action.split(':', 1)[0]}:*`)),
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES = Object.freeze([
+    'AmazonSSMManagedInstanceCore',
+    'service-role/AmazonECSTaskExecutionRolePolicy',
+    'service-role/AWSLambdaBasicDurableExecutionRolePolicy',
+    'service-role/AWSLambdaBasicExecutionRole',
+    'service-role/AWSLambdaVPCAccessExecutionRole',
+]);
+exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS = Object.freeze([
+    'iam:AttachRolePolicy',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePolicy',
+].sort(compareStrings));
+const IAM_AUTHORITY_MUTATION_ACTIONS = Object.freeze([
+    'iam:AddRoleToInstanceProfile',
+    'iam:AttachRolePolicy',
+    'iam:CreatePolicyVersion',
+    'iam:DeletePolicy',
+    'iam:DeletePolicyVersion',
+    'iam:DeleteRole',
+    'iam:DeleteRolePermissionsBoundary',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePermissionsBoundary',
+    'iam:PutRolePolicy',
+    'iam:RemoveRoleFromInstanceProfile',
+    'iam:SetDefaultPolicyVersion',
+    'iam:TagPolicy',
+    'iam:TagRole',
+    'iam:UntagPolicy',
+    'iam:UntagRole',
+    'iam:UpdateAssumeRolePolicy',
+    'iam:UpdateRole',
+    'iam:UpdateRoleDescription',
+].sort(compareStrings));
+/** Compact service-family scope guards keep mutation outside the selected AWS
+ * account/Region closed. They intentionally do not claim same-account stage
+ * isolation, because native SST owns account-shared bootstrap resources. */
+exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES = Object.freeze([
+    ...new Set([
+        ...exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES,
+        'acm:*',
+        'apigateway:*',
+        'cloudfront:*',
+        'iam:*',
+        'logs:*',
+        'route53:*',
+        's3:*',
+        'wafv2:*',
+    ]),
+].sort(compareStrings));
+/** SST 4.17.1 resolves the generated nonproduction VPC's EC2 NAT image from
+ * this commercial-partition fck-nat publisher. The generated development
+ * bastion reuses that NAT instance, while production uses managed NAT. No
+ * publisher is admitted in partitions where the pinned source is unproven. */
+exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION = Object.freeze({
+    aws: Object.freeze(['568608671756']),
+    'aws-cn': Object.freeze([]),
+    'aws-us-gov': Object.freeze([]),
+});
+/** Preserve the generic cross-account guard for ordinary EC2 mutations while
+ * routing RunInstances through its resource-aware statements below. A service
+ * family wildcard would otherwise reject SST's deliberately external AMI. */
+exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS = Object.freeze(exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS.filter((action) => action.startsWith('ec2:') && action !== 'ec2:RunInstances'));
+exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_SCOPE_GUARD_MUTATION_FAMILIES.filter((action) => action !== 'ec2:*'),
+    ...exports.STAGE_AUTHORITY_CROSS_ACCOUNT_EC2_MUTATION_ACTIONS,
+].sort(compareStrings));
+/** A deliberately narrow destructive set for same-account stage defense in
+ * depth. It protects named/tagged production resources without pretending the
+ * deployment roles form a complete IAM boundary. */
+exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS = Object.freeze([
+    'backup:Delete*',
+    'budgets:ModifyBudget',
+    'budgets:TagResource',
+    'budgets:UntagResource',
+    'cloudformation:DeleteStack',
+    'cloudformation:UpdateStack',
+    'cloudfront:CreateInvalidation',
+    'cloudfront:Delete*',
+    'cloudfront:PublishFunction',
+    'cloudfront:TagResource',
+    'cloudfront:UntagResource',
+    'cloudfront:Update*',
+    'cognito-idp:Delete*',
+    'dynamodb:Delete*',
+    'ec2:Replace*',
+    'ecr:BatchDeleteImage',
+    'ecr:Delete*',
+    'events:DeleteArchive',
+    'events:DeleteEventBus',
+    'events:DeleteRule',
+    'events:RemoveTargets',
+    'events:UpdateArchive',
+    'events:UpdateEventBus',
+    'iam:Delete*',
+    'kms:ScheduleKeyDeletion',
+    'lambda:Delete*',
+    'rds:Delete*',
+    'rds:ModifyDBCluster',
+    'rds:ModifyDBInstance',
+    'rds:AddSourceIdentifierToSubscription',
+    'rds:RemoveSourceIdentifierFromSubscription',
+    's3:AbortMultipartUpload',
+    's3:CreateBucket',
+    's3:DeleteBucket',
+    's3:DeleteBucketPolicy',
+    's3:DeleteObject*',
+    's3:PutBucket*',
+    's3:PutObject*',
+    's3:RestoreObject',
+    'secretsmanager:DeleteSecret',
+    'servicediscovery:DeleteNamespace',
+    'sqs:DeleteQueue',
+    'ssm:DeleteParameter*',
+    'states:DeleteStateMachine',
+    'wafv2:Delete*',
+    'wafv2:DisassociateWebACL',
+    'wafv2:PutLoggingConfiguration',
+    'wafv2:Update*',
+].sort(compareStrings));
+/** Existing-resource mutations must either retain the exact stage tag or use a
+ * generated stage/SST shared resource identity. Initial create/tag calls are
+ * governed by their request-tag or exact-resource statements instead. */
+exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_CROSS_STAGE_DESTRUCTIVE_ACTIONS.filter((action) => !action.startsWith('cloudfront:') && action !== 's3:CreateBucket'),
+    'cloudfront:DeleteDistribution',
+    'cloudfront:DeleteFunction',
+    'cloudfront:PublishFunction',
+    'cloudfront:UpdateDistribution',
+    'cloudfront:UpdateFunction',
+].sort(compareStrings));
+/** Operations whose target already exposes a stage tag may use the broader
+ * deployer contract. A known different-stage tag must still win as an explicit
+ * deny, including for provider calls that are not destructive by name. */
+exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS = Object.freeze([
+    ...new Set([
+        ...exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES,
+        'acm:*',
+        'budgets:*',
+        'cloudformation:*',
+        'cloudfront:*',
+        'iam:*',
+        'logs:*',
+        's3:*',
+        'wafv2:*',
+    ]),
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS = Object.freeze(['s3:DeleteBucketPolicy', 's3:PutBucketPolicy'].sort(compareStrings));
+const PRIVILEGE_CONSTRUCTION_ACTIONS = Object.freeze([
+    'account:*',
+    'iam:AttachGroupPolicy',
+    'iam:AttachUserPolicy',
+    'iam:CreateAccessKey',
+    'iam:CreateGroup',
+    'iam:CreateLoginProfile',
+    'iam:CreatePolicy',
+    'iam:CreatePolicyVersion',
+    'iam:CreateUser',
+    'iam:DeleteRolePermissionsBoundary',
+    'iam:PutGroupPolicy',
+    'iam:PutUserPermissionsBoundary',
+    'iam:PutUserPolicy',
+    'iam:SetDefaultPolicyVersion',
+    'organizations:*',
+    'sts:AssumeRole',
+].sort(compareStrings));
+const RUNTIME_PRIVILEGE_ACTIONS = Object.freeze([
+    ...PRIVILEGE_CONSTRUCTION_ACTIONS,
+    'iam:AttachRolePolicy',
+    'iam:CreateInstanceProfile',
+    'iam:CreateRole',
+    'iam:DeleteRole',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePermissionsBoundary',
+    'iam:PutRolePolicy',
+    'iam:UpdateAssumeRolePolicy',
+].sort(compareStrings));
+/** Permission-management actions that the generated lifecycle must call. Each
+ * exception is named exactly here and remains subject to the resource and
+ * condition containment statements below. */
+exports.STAGE_AUTHORITY_REVIEWED_PERMISSION_MANAGEMENT_ACTIONS = Object.freeze([
+    'iam:AttachRolePolicy',
+    'iam:DeleteRolePolicy',
+    'iam:DetachRolePolicy',
+    'iam:PutRolePermissionsBoundary',
+    'iam:PutRolePolicy',
+    'kms:CreateGrant',
+    'lambda:AddPermission',
+    'lambda:RemovePermission',
+    'logs:PutResourcePolicy',
+    's3:DeleteBucketPolicy',
+    's3:PutBucketOwnershipControls',
+    's3:PutBucketPolicy',
+    's3:PutBucketPublicAccessBlock',
+    'sns:SetTopicAttributes',
+    'sqs:SetQueueAttributes',
+].sort(compareStrings));
+/** Compact deny patterns covering permission-management actions admitted by
+ * wildcard lifecycle grants but not named as reviewed exceptions. The focused
+ * oracle derives every wildcard service family from the policy and proves each
+ * currently admitted permission-management action is reviewed or denied, and
+ * that no compact pattern also captures a retained read-only action. */
+exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS = Object.freeze([
+    'apigateway:*AccessAssociation',
+    'apigateway:*Certificate*Domain',
+    'apigateway:DeletePortalProductSharingPolicy',
+    'apigateway:PutPortalProductSharingPolicy',
+    'apigateway:SetWebACL',
+    'apigateway:Update*Policy',
+    'backup:DeleteBackupVault*Policy',
+    'backup:ListIndexedRecoveryPointsForSearch',
+    'backup:PutBackupVault*Policy',
+    'backup:SearchRecoveryPoint',
+    'cloudfront:AllowVendedLogDeliveryForResource',
+    'dynamodb:DeleteResourcePolicy',
+    'dynamodb:PutResourcePolicy',
+    'dynamodb:UpdateAbacStatus',
+    'ec2:*Appliance*NatGateway',
+    'ec2:*ImageBlockPublicAccess',
+    'ec2:*OdbNetworkPeering',
+    'ec2:*Permission',
+    'ec2:*Resources*PlacementGroup',
+    'ec2:*SnapshotBlockPublicAccess',
+    'ec2:DeleteResourcePolicy',
+    'ec2:ModifySnapshotAttribute',
+    'ec2:ModifyVpcEndpointServicePermissions',
+    'ec2:PutResourcePolicy',
+    'ec2:ResetSnapshotAttribute',
+    'ecr:DeleteRegistryPolicy',
+    'ecr:DeleteRepositoryPolicy',
+    'ecr:PutRegistryPolicy',
+    'ecr:SetRepositoryPolicy',
+    'ecs:AllowVendedLogDeliveryForResource',
+    'elasticloadbalancing:AllowVendedLogDeliveryForResource',
+    'events:*Permission',
+    'kms:PutKeyPolicy',
+    'kms:RetireGrant',
+    'kms:RevokeGrant',
+    'lambda:*LayerVersionPermission',
+    'lambda:*Replication',
+    'lambda:DeleteResourcePolicy',
+    'lambda:PutResourcePolicy',
+    'logs:DeleteResourcePolicy',
+    'rds:AuthorizeDBSecurityGroupIngress',
+    's3:AssociateAccessGrantsIdentityCenter',
+    's3:BypassGovernanceRetention',
+    's3:CreateAccessGrant*',
+    's3:Delete*AccessPointPolicy*',
+    's3:DeleteAccessGrant*',
+    's3:DissociateAccessGrantsIdentityCenter',
+    's3:ObjectOwnerOverrideToBucketOwner',
+    's3:Put*AccessPointPolicy*',
+    's3:Put*Acl',
+    's3:PutAccessGrantsInstanceResourcePolicy',
+    's3:PutAccessPointPublicAccessBlock',
+    's3:PutAccountPublicAccessBlock',
+    's3:UpdateAccessGrantsLocation',
+    'secretsmanager:DeleteResourcePolicy',
+    'secretsmanager:PutResourcePolicy',
+    'secretsmanager:ValidateResourcePolicy',
+    'sns:*Permission',
+    'sqs:*Permission',
+    'ssm:*ResourcePolicy',
+    'ssm:ModifyDocumentPermission',
+    'wafv2:DeletePermissionPolicy',
+    'wafv2:PutPermissionPolicy',
+].sort(compareStrings));
+const ADDITIONAL_RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS = Object.freeze([
+    'ec2:AcceptTransitGatewayPeeringAttachment',
+    'ec2:AcceptVpcPeeringConnection',
+    'ec2:CreateTransitGatewayPeeringAttachment',
+    'ec2:CreateVpcEndpointServiceConfiguration',
+    'ec2:CreateVpcPeeringConnection',
+    'ec2:DeleteVpcEndpointServiceConfigurations',
+    'ec2:ModifyImageAttribute',
+    'ec2:ModifyVpcEndpointServiceConfiguration',
+    'ec2:ModifyVpcPeeringConnectionOptions',
+    'ecr:PutReplicationConfiguration',
+    'iam:UpdateAssumeRolePolicy',
+    'logs:DeleteAccountPolicy',
+    'logs:DeleteDeliveryDestinationPolicy',
+    'logs:PutAccountPolicy',
+    'logs:PutDeliveryDestinationPolicy',
+    'logs:PutDestinationPolicy',
+    'rds:ModifyDBClusterSnapshotAttribute',
+    'rds:ModifyDBSnapshotAttribute',
+    'states:DeleteResourcePolicy',
+    'states:PutResourcePolicy',
+    'states:RevealSecrets',
+    'states:TestState',
+].sort(compareStrings));
+const RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS = Object.freeze([
+    ...exports.STAGE_AUTHORITY_UNREVIEWED_PERMISSION_MANAGEMENT_ACTION_PATTERNS,
+    ...ADDITIONAL_RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS,
+].sort(compareStrings));
+/** Stable exclusions from the temporary infrastructure-administrator role.
+ * These are account administration, direct application data/user mutation,
+ * message handling, or export paths rather than native stack reconciliation.
+ * The generated deployed smoke retains only its four exact Cognito admin calls. */
+exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS = Object.freeze([
+    'acm:*Acme*',
+    'acm:ExportCertificate',
+    'acm:PutAccountConfiguration',
+    'appconfig:UpdateAccountSettings',
+    'cognito-idp:AdminConfirmSignUp',
+    'cognito-idp:AdminDeleteUserAttributes',
+    'cognito-idp:AdminDisable*',
+    'cognito-idp:AdminEnableUser',
+    'cognito-idp:AdminForgetDevice',
+    'cognito-idp:*Auth*',
+    'cognito-idp:*Device*',
+    'cognito-idp:*UserMFA*',
+    'cognito-idp:AdminGetUser',
+    'cognito-idp:AdminLinkProviderForUser',
+    'cognito-idp:AdminList*',
+    'cognito-idp:AdminRemoveUserFromGroup',
+    'cognito-idp:AdminResetUserPassword',
+    'cognito-idp:AdminSetUserSettings',
+    'cognito-idp:AdminUpdateUserAttributes',
+    'cognito-idp:AdminUserGlobalSignOut',
+    'cognito-idp:ChangePassword',
+    'cognito-idp:ConfirmForgotPassword',
+    'cognito-idp:ConfirmSignUp',
+    'cognito-idp:DeleteUser',
+    'cognito-idp:DeleteUserAttributes',
+    'cognito-idp:ForgotPassword',
+    'cognito-idp:GetTokensFromRefreshToken',
+    'cognito-idp:GetUser',
+    'cognito-idp:GetUserAttributeVerificationCode',
+    'cognito-idp:GlobalSignOut',
+    'cognito-idp:ListUsers*',
+    'cognito-idp:ResendConfirmationCode',
+    'cognito-idp:RevokeToken',
+    'cognito-idp:SetUser*',
+    'cognito-idp:SignUp',
+    'cognito-idp:UpdateUserAttributes',
+    'cognito-idp:VerifySoftwareToken',
+    'cognito-idp:VerifyUserAttribute',
+    'dynamodb:*Item*',
+    'dynamodb:ExportTableToPointInTime',
+    'dynamodb:GetRecords',
+    'dynamodb:GetShardIterator',
+    'dynamodb:ImportTable',
+    'dynamodb:PartiQL*',
+    'dynamodb:PurchaseReservedCapacityOfferings',
+    'dynamodb:Query',
+    'dynamodb:ReadDataForReplication',
+    'dynamodb:RestoreTableFrom*',
+    'dynamodb:Scan',
+    'dynamodb:WriteDataForReplication',
+    'ecr:CreatePullThroughCacheRule',
+    'ecr:CreateRepositoryCreationTemplate',
+    'ecr:DeletePullThroughCacheRule',
+    'ecr:DeleteRepositoryCreationTemplate',
+    'ecr:DeleteSigningConfiguration',
+    'ecr:PutAccountSetting',
+    'ecr:PutRegistryScanningConfiguration',
+    'ecr:PutSigningConfiguration',
+    'ecr:UpdatePullThroughCacheRule',
+    'ecr:UpdateRepositoryCreationTemplate',
+    'ecs:DeleteAccountSetting',
+    'ecs:ExecuteCommand',
+    'ecs:PutAccountSetting',
+    'ecs:PutAccountSettingDefault',
+    'ecs:RunTask',
+    'ecs:StartTask',
+    'ecs:StopTask',
+    'logs:CancelExportTask',
+    'logs:CreateExportTask',
+    'rds:CancelExportTask',
+    'rds:ModifyCertificates',
+    'rds:PurchaseReservedDBInstancesOffering',
+    'rds:StartExportTask',
+    'secretsmanager:CancelRotateSecret',
+    'secretsmanager:RotateSecret',
+    'secretsmanager:UpdateSecretVersionStage',
+    'sns:*PhoneNumber*',
+    'sns:*SMS*',
+    'sqs:*Message*',
+    'sqs:PurgeQueue',
+    'ssm:CreateActivation',
+    'ssm:ResumeSession',
+    'ssm:SendCommand',
+    'ssm:StartAutomationExecution',
+    'ssm:StartChangeRequestExecution',
+    'ssm:StartSession',
+    'ssm:TerminateSession',
+].sort(compareStrings));
+const SECRET_BATCH_VALUE_READ_ACTIONS = Object.freeze([
+    'secretsmanager:BatchGetSecretValue',
+]);
+const GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS = Object.freeze(['secretsmanager:GetSecretValue', 'secretsmanager:PutSecretValue'].sort(compareStrings));
+const STAGE_SECRET_CONTAINER_METADATA_UPDATE_ACTIONS = Object.freeze([
+    'secretsmanager:UpdateSecret',
+]);
+const GENERATED_FOUNDATION_DATABASE_RECONCILIATION_ACTIONS = Object.freeze([
+    ...GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS,
+    ...STAGE_SECRET_CONTAINER_METADATA_UPDATE_ACTIONS,
+].sort(compareStrings));
+const SSM_HISTORY_AND_RECURSIVE_VALUE_READ_ACTIONS = Object.freeze(['ssm:GetParameterHistory', 'ssm:GetParametersByPath'].sort(compareStrings));
+const WORKFLOW_EXECUTION_MUTATION_ACTIONS = Object.freeze([
+    'states:RedriveExecution',
+    'states:StartExecution',
+    'states:StartSyncExecution',
+    'states:StopExecution',
+].sort(compareStrings));
+exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS = Object.freeze([
+    'states:RedriveExecution',
+    'states:StartSyncExecution',
+    'states:StopExecution',
+].sort(compareStrings));
+const LAMBDA_INTEGRATION_PRINCIPALS = Object.freeze([
+    'apigateway.amazonaws.com',
+    'cloudfront.amazonaws.com',
+    'events.amazonaws.com',
+].sort(compareStrings));
+const REVIEWED_LAMBDA_PERMISSION_PRINCIPALS = Object.freeze([...LAMBDA_INTEGRATION_PRINCIPALS, '*'].sort(compareStrings));
+exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES = Object.freeze([
+    Object.freeze({
+        path: 'ecs.amazonaws.com/AWSServiceRoleForECS',
+        serviceName: 'ecs.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService',
+        serviceName: 'ecs.application-autoscaling.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'rds.amazonaws.com/AWSServiceRoleForRDS',
+        serviceName: 'rds.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster',
+        serviceName: 'rds.application-autoscaling.amazonaws.com',
+    }),
+    Object.freeze({
+        path: 'wafv2.amazonaws.com/AWSServiceRoleForWAFV2Logging',
+        serviceName: 'wafv2.amazonaws.com',
+    }),
+]);
+const IAM_POLICY_VERSION = '2012-10-17';
+function compareStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function githubOidcAudience(partition) {
+    return partition === 'aws-cn' ? 'sts.amazonaws.com.cn' : 'sts.amazonaws.com';
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => compareStrings(left, right))
+        .map(([key, entry]) => [key, canonicalize(entry)]));
+}
+function deepFreeze(value) {
+    if (!value || typeof value !== 'object' || Object.isFrozen(value)) {
+        return value;
+    }
+    for (const entry of Object.values(value))
+        deepFreeze(entry);
+    return Object.freeze(value);
+}
+function policy(statements) {
+    return {
+        Statement: [...statements].sort((left, right) => compareStrings(left.Sid, right.Sid)),
+        Version: IAM_POLICY_VERSION,
+    };
+}
+function omitPolicyStatementSids(document) {
+    const record = document;
+    const statements = record['Statement'];
+    if (!Array.isArray(statements)) {
+        throw new Error('Stage authority template policy statements are invalid.');
+    }
+    return {
+        ...record,
+        Statement: statements.map((entry) => {
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+                throw new Error('Stage authority template policy statement is invalid.');
+            }
+            return Object.fromEntries(Object.entries(entry).filter(([key]) => key !== 'Sid'));
+        }),
+    };
+}
+function replaceExactTemplateString(value, expected, replacement) {
+    if (value === expected)
+        return replacement;
+    if (Array.isArray(value)) {
+        return value.map((entry) => replaceExactTemplateString(entry, expected, replacement));
+    }
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+        key,
+        replaceExactTemplateString(entry, expected, replacement),
+    ]));
+}
+function compactExactTemplatePolicyStrings(documents, values) {
+    const constants = {};
+    const replacements = new Map();
+    for (const value of [...new Set(values)].sort(compareStrings)) {
+        const key = `A${replacements.size}`;
+        const replacement = Object.freeze({
+            'Fn::FindInMap': Object.freeze(['A', 'V', key]),
+        });
+        constants[key] = value;
+        replacements.set(value, replacement);
+    }
+    if (replacements.size === 0)
+        return Object.freeze({ documents });
+    const compactedDocuments = Object.fromEntries(Object.entries(documents).map(([logicalId, document]) => [
+        logicalId,
+        [...replacements.entries()].reduce((current, [arn, replacement]) => replaceExactTemplateString(current, arn, replacement), document),
+    ]));
+    return Object.freeze({
+        documents: Object.freeze(compactedDocuments),
+        // These short, template-private identifiers avoid repeating long exact
+        // ARNs in policy documents. Fn::FindInMap resolves to the original literal
+        // before IAM sees the policy; the executable policy model stays literal.
+        mappings: Object.freeze({
+            A: Object.freeze({ V: Object.freeze(constants) }),
+        }),
+    });
+}
+function statement(input) {
+    if ((input.Resource === undefined) === (input.NotResource === undefined)) {
+        throw new Error('Stage authority statements require exactly one Resource or NotResource scope.');
+    }
+    return {
+        ...input,
+        Action: [...input.Action].sort(compareStrings),
+        ...(input.Resource
+            ? { Resource: [...input.Resource].sort(compareStrings) }
+            : {}),
+        ...(input.NotResource
+            ? { NotResource: [...input.NotResource].sort(compareStrings) }
+            : {}),
+    };
+}
+function requireIdentity(input) {
+    const partition = input.partition ?? 'aws';
+    if (!ACCOUNT_ID.test(input.accountId) ||
+        !REGION.test(input.region) ||
+        !exports.STAGE_AUTHORITY_STAGES.includes(input.stage) ||
+        !exports.STAGE_AUTHORITY_PARTITIONS.includes(partition)) {
+        throw new Error('Stage authority requires one exact account, Region, partition, and canonical stage.');
+    }
+    return {
+        accountId: input.accountId,
+        partition,
+        region: input.region,
+        stage: input.stage,
+    };
+}
+function createStageAuthorityIdentity(input) {
+    const identity = requireIdentity(input);
+    const boundaryPath = `/ebk/${identity.stage}/`;
+    const boundaryName = `workload-role-boundary-${identity.stage}`;
+    const deploymentRolePath = `/ebk/${identity.stage}/deployment/`;
+    const deploymentRoleName = `ebk-${identity.stage}-deploy`;
+    const deploymentPolicyNames = Object.freeze([
+        `stage-deployment-read-${identity.stage}`,
+        `stage-deployment-regional-mutation-${identity.stage}`,
+        `stage-deployment-global-iam-mutation-${identity.stage}`,
+        `stage-deployment-global-resource-mutation-${identity.stage}`,
+        `stage-deployment-generated-resource-mutation-${identity.stage}`,
+        `stage-deployment-stage-containment-${identity.stage}`,
+        `stage-deployment-permission-guardrails-${identity.stage}`,
+        `stage-deployment-guardrails-${identity.stage}`,
+    ]);
+    const workloadRolePath = `/ebk/${identity.stage}/workloads/`;
+    const workloadInstanceProfilePath = workloadRolePath;
+    return Object.freeze({
+        boundaryArn: `arn:${identity.partition}:iam::${identity.accountId}:policy${boundaryPath}${boundaryName}`,
+        boundaryName,
+        boundaryPath,
+        deploymentPolicyArns: Object.freeze(deploymentPolicyNames.map((name) => `arn:${identity.partition}:iam::${identity.accountId}:policy${deploymentRolePath}${name}`)),
+        deploymentPolicyNames,
+        deploymentRoleArn: `arn:${identity.partition}:iam::${identity.accountId}:role${deploymentRolePath}${deploymentRoleName}`,
+        deploymentRoleName,
+        deploymentRolePath,
+        stackName: `ebk-${identity.stage}-stage-authority`,
+        workloadInstanceProfileArnPattern: `arn:${identity.partition}:iam::${identity.accountId}:instance-profile${workloadInstanceProfilePath}*`,
+        workloadInstanceProfilePath,
+        workloadRoleArnPattern: `arn:${identity.partition}:iam::${identity.accountId}:role${workloadRolePath}*`,
+        workloadRolePath,
+    });
+}
+function requireTrust(input, identity) {
+    const principals = [...new Set(input.awsPrincipalArns ?? [])].sort(compareStrings);
+    if (principals.length > STAGE_AUTHORITY_MAX_AWS_PRINCIPALS ||
+        principals.some((arn) => {
+            const match = AWS_PRINCIPAL_ARN.exec(arn);
+            return (Buffer.byteLength(arn, 'utf8') >
+                STAGE_AUTHORITY_MAX_AWS_PRINCIPAL_ARN_BYTES ||
+                !match ||
+                match[1] !== identity.partition);
+        })) {
+        throw new Error('Stage authority AWS trust must contain at most 16 bounded unique exact principal ARNs in the selected partition.');
+    }
+    const statements = [];
+    if (principals.length > 0) {
+        statements.push({
+            Action: 'sts:AssumeRole',
+            Effect: 'Allow',
+            Principal: { AWS: principals },
+            Sid: 'AssumeFromReviewedAwsPrincipals',
+        });
+    }
+    if (input.github) {
+        const match = GITHUB_OIDC_PROVIDER_ARN.exec(input.github.oidcProviderArn);
+        const subjectMatch = GITHUB_SUBJECT.exec(input.github.subject);
+        if (!match ||
+            match[1] !== identity.partition ||
+            match[2] !== identity.accountId ||
+            !subjectMatch) {
+            throw new Error('Stage authority GitHub trust must use the target account provider and one immutable environment subject.');
+        }
+        if (subjectMatch[1] !== identity.stage) {
+            throw new Error('Stage authority GitHub trust environment must match the selected stage.');
+        }
+        statements.push({
+            Action: 'sts:AssumeRoleWithWebIdentity',
+            Condition: {
+                StringEquals: {
+                    'token.actions.githubusercontent.com:aud': githubOidcAudience(identity.partition),
+                    'token.actions.githubusercontent.com:sub': input.github.subject,
+                },
+            },
+            Effect: 'Allow',
+            Principal: { Federated: input.github.oidcProviderArn },
+            Sid: 'AssumeFromReviewedGithubEnvironment',
+        });
+    }
+    if (statements.length === 0) {
+        throw new Error('Stage authority requires at least one reviewed AWS or GitHub trust principal.');
+    }
+    return {
+        Statement: statements.sort((left, right) => compareStrings(String(left['Sid']), String(right['Sid']))),
+        Version: IAM_POLICY_VERSION,
+    };
+}
+function runtimeBoundaryPolicy(options) {
+    return policy([
+        statement({
+            Action: exports.STAGE_RUNTIME_REGIONAL_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'AllowFixedRuntimeServicesInStageRegion',
+        }),
+        statement({
+            Action: ['sts:GetCallerIdentity'],
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'AllowRuntimeCallerIdentity',
+        }),
+        statement({
+            Action: exports.STAGE_RUNTIME_GLOBAL_ACTIONS,
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'AllowFixedRuntimeGlobalServices',
+        }),
+        statement({
+            Action: ['iam:PassRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:PassedToService': [
+                        'appconfig.amazonaws.com',
+                        'ec2.amazonaws.com',
+                        'ecs-tasks.amazonaws.com',
+                        'lambda.amazonaws.com',
+                        'states.amazonaws.com',
+                    ].sort(compareStrings),
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'AllowRuntimePassBoundedStageRoles',
+        }),
+        statement({
+            Action: exports.STAGE_RUNTIME_REGIONAL_SERVICE_FAMILIES,
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimeOutsideStageRegion',
+        }),
+        statement({
+            Action: ['*'],
+            Condition: {
+                Null: { 'aws:ResourceAccount': 'false' },
+                StringNotEquals: { 'aws:ResourceAccount': options.accountId },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimeCrossAccountResources',
+        }),
+        statement({
+            Action: ['*'],
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'false' },
+                StringNotEquals: { 'aws:ResourceTag/ebk:stage': options.stage },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimeKnownOtherStageResources',
+        }),
+        statement({
+            Action: RUNTIME_PRIVILEGE_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyRuntimePrivilegeConstruction',
+        }),
+    ]);
+}
+const SST_4_17_1_PHYSICAL_NAME_RANDOM_SUFFIX_LENGTH = 9;
+const FOUNDATION_ROUTER_CLOUDFRONT_FUNCTION_NAMES = [
+    'FoundationRouterCloudfrontFunctionRequest',
+    'FoundationRouterCloudfrontFunctionResponse',
+];
+function sst4171PhysicalNamePattern(input) {
+    const maximumPrefixLength = input.maximumLength - SST_4_17_1_PHYSICAL_NAME_RANDOM_SUFFIX_LENGTH;
+    const stageLength = input.stage.length;
+    const nameLength = input.logicalName.length;
+    const prefix = nameLength + 1 >= maximumPrefixLength
+        ? input.logicalName.substring(0, maximumPrefixLength)
+        : nameLength + stageLength + 2 >= maximumPrefixLength
+            ? `${input.stage.substring(0, maximumPrefixLength - nameLength - 1)}-${input.logicalName}`
+            : `${input.application.substring(0, maximumPrefixLength - stageLength - nameLength - 2)}-${input.stage}-${input.logicalName}`;
+    return `${prefix}-*`;
+}
+function generatedRouterCloudFrontFunctionResources(options, stage) {
+    return FOUNDATION_ROUTER_CLOUDFRONT_FUNCTION_NAMES.map((logicalName) => `arn:${options.partition}:cloudfront::${options.accountId}:function/${sst4171PhysicalNamePattern({
+        application: 'foundation',
+        logicalName,
+        maximumLength: 64,
+        stage,
+    })}`).sort(compareStrings);
+}
+function deploymentPolicy(options) {
+    const edgeRegion = edgeControlRegion(options.partition, options.region);
+    const managedPolicies = exports.STAGE_AUTHORITY_APPROVED_AWS_MANAGED_POLICIES.map((name) => `arn:${options.partition}:iam::aws:policy/${name}`);
+    const productionDatabaseResources = [
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:cluster:*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:db:*`,
+    ];
+    const productionRetentionResources = [
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:backup-plan:*`,
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:backup-vault:*`,
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:recovery-point:*`,
+    ];
+    const productionDataExportBucketResources = [
+        `arn:${options.partition}:s3:::ebk-${options.accountId}-production-*-data-export`,
+        `arn:${options.partition}:s3:::ebk-${options.accountId}-production-*-data-export/*`,
+    ];
+    const productionDataExportAliasResources = [
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:alias/ebk-production-*-data-export`,
+    ];
+    const stageLambdaResources = [
+        `arn:${options.partition}:lambda:${options.region}:${options.accountId}:function:*`,
+    ];
+    const foundationNatWorkloadRoleResources = [
+        `arn:${options.partition}:iam::${options.accountId}:role${options.identity.workloadRolePath}ebk-${options.stage}-foundation-nat`,
+    ];
+    const stageCloudFrontDistributionResources = [
+        `arn:${options.partition}:cloudfront::${options.accountId}:distribution/*`,
+    ];
+    const stageRouterWebAclResources = [
+        `arn:${options.partition}:wafv2:${edgeRegion}:${options.accountId}:global/webacl/*-${options.stage}-*/*`,
+    ];
+    const stageRouterCloudFrontFunctionResources = generatedRouterCloudFrontFunctionResources(options, options.stage);
+    const productionRouterCloudFrontFunctionResources = generatedRouterCloudFrontFunctionResources(options, 'production');
+    const stageRouterWafLogDestinationResources = [
+        `arn:${options.partition}:logs:${edgeRegion}:${options.accountId}:log-group:aws-waf-logs-foundation-${options.stage}-FoundationRouter-*`,
+    ];
+    const generatedEdgeLogGroupMutationResources = [
+        ...stageRouterWafLogDestinationResources,
+        ...(options.region === edgeRegion
+            ? [
+                `arn:${options.partition}:logs:${options.region}:${options.accountId}:log-group:/aws/vendedlogs/apis/*-${options.stage}-*`,
+                `arn:${options.partition}:logs:${options.region}:${options.accountId}:log-group:/ebk/${options.stage}/*`,
+            ]
+            : []),
+    ].sort(compareStrings);
+    const productionEventSubscriptionResources = [
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:es:*`,
+    ];
+    const stageAccountBudgetResources = [
+        `arn:${options.partition}:budgets::${options.accountId}:budget/*`,
+    ];
+    const stageTopicResources = [
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:*-${options.stage}-*`,
+    ];
+    const generatedFoundationAlertTopicResources = [
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:foundation-${options.stage}-FoundationAlertsTopic-*`,
+    ];
+    const stageQueueResources = [
+        `arn:${options.partition}:sqs:${options.region}:${options.accountId}:*-${options.stage}-*`,
+    ];
+    const stageReadableSsmValueResources = [
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/ebk/${options.stage}/workspace-owner`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/ebk/${options.stage}/foundation/*`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/bootstrap`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/passphrase/*/${options.stage}`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/sst/vpc/vpc-*/private-key-value`,
+    ].sort(compareStrings);
+    const immutableWorkspaceOwnerResources = [
+        'development',
+        'production',
+        'staging',
+    ]
+        .map((stage) => `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/ebk/${stage}/workspace-owner`)
+        .sort(compareStrings);
+    // SST 4.17.1 models the generated Aurora credential as a managed
+    // SecretVersion. The pinned AWS provider needs PutSecretValue to create it
+    // and GetSecretValue to reconcile its AWSCURRENT version during removal.
+    // Keep those value operations bound to the one Foundation-owned
+    // physical-name and stage-tag contract; operator/generated paths and every
+    // other secret value remain explicitly outside this exception.
+    const generatedFoundationDatabaseCredentialResources = [
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:foundation-${options.stage}-FoundationDatabaseProxySecret-*`,
+    ];
+    // Native providers reconcile an EBK-owned Secret container through
+    // UpdateSecret regardless of whether it holds a generated database
+    // credential, a machine credential, or operator-supplied material. Bind that
+    // metadata lifecycle to the stable stage-owned namespace instead of
+    // enumerating today's generated container purposes. UpdateSecret can itself
+    // carry plaintext, so reviewed generated source, temporary deployer
+    // credentials, and CloudTrail remain the honest controls. GetSecretValue and
+    // PutSecretValue stay excluded from every Slice container.
+    const stageOwnedSecretContainerResources = [
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:ebk/${options.stage}/*`,
+    ];
+    const stageSecretContainerMetadataUpdateResources = [
+        ...generatedFoundationDatabaseCredentialResources,
+        ...stageOwnedSecretContainerResources,
+    ].sort(compareStrings);
+    const machineAuthorizationStackResources = [
+        `arn:${options.partition}:cloudformation:${options.region}:${options.accountId}:stack/*MachineAuthorization*/*`,
+    ];
+    const costAnomalyMonitorResources = [
+        `arn:${options.partition}:ce::${options.accountId}:anomalymonitor/*`,
+    ];
+    const costAnomalySubscriptionResources = [
+        `arn:${options.partition}:ce::${options.accountId}:anomalysubscription/*`,
+    ];
+    const costAnomalyResources = [
+        ...costAnomalyMonitorResources,
+        ...costAnomalySubscriptionResources,
+    ].sort(compareStrings);
+    const productionCostScope = '*/account/production';
+    const eventArchiveResources = [
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:archive/ebk-${options.stage}-foundation-events`,
+    ];
+    const foundationEventBusResources = [
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:event-bus/foundation-${options.stage}-FoundationEventBusBus-*`,
+    ];
+    const stageKmsKeyResources = [
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:key/*`,
+    ];
+    const stageKmsAliasResources = [
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:alias/ebk-${options.stage}-*-data-export`,
+    ];
+    const stageStateMachineResources = [
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:stateMachine:*-${options.stage}-*`,
+    ];
+    // Native SST physical state-machine names are derived from Pulumi logical
+    // names and do not necessarily contain the stage. Step Functions exposes the
+    // state machine's resource tags while authorizing both the state machine and
+    // its Standard executions, so the governed execution path uses the exact
+    // account/Region namespace plus the stage tag instead of a name convention.
+    const accountStateMachineResources = [
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:stateMachine:*`,
+    ];
+    const accountExecutionResources = [
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:execution:*:*`,
+    ];
+    const serviceLinkedRoleResources = exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES.map(({ path }) => `arn:${options.partition}:iam::${options.accountId}:role/aws-service-role/${path}`);
+    const stageAndSharedMutationResources = [
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:*:*${options.stage}*`,
+        `arn:${options.partition}:budgets::${options.accountId}:budget/*`,
+        ...stageRouterCloudFrontFunctionResources,
+        `arn:${options.partition}:dynamodb:${options.region}:${options.accountId}:table/*-${options.stage}-*`,
+        `arn:${options.partition}:ecr:${options.region}:${options.accountId}:repository/ebk/${options.stage}/*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:archive/ebk-${options.stage}-*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:event-bus/*-${options.stage}-*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:rule/*-${options.stage}-*`,
+        `arn:${options.partition}:iam::${options.accountId}:instance-profile/ebk/${options.stage}/workloads/*`,
+        `arn:${options.partition}:iam::${options.accountId}:role/ebk/${options.stage}/workloads/*`,
+        ...stageKmsAliasResources,
+        `arn:${options.partition}:lambda:${options.region}:${options.accountId}:function:*-${options.stage}-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:cluster:*-${options.stage}-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:db:*-${options.stage}-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:snapshot:*-${options.stage}-*`,
+        `arn:${options.partition}:s3:::*-${options.stage}-*`,
+        `arn:${options.partition}:s3:::*-${options.stage}-*/*`,
+        `arn:${options.partition}:s3:::sst-asset-*`,
+        `arn:${options.partition}:s3:::sst-asset-*/*`,
+        `arn:${options.partition}:s3:::sst-state-*`,
+        `arn:${options.partition}:s3:::sst-state-*/*`,
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:ebk/${options.stage}/*`,
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:*-${options.stage}-*`,
+        `arn:${options.partition}:sqs:${options.region}:${options.accountId}:*-${options.stage}-*`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/*${options.stage}*`,
+        ...stageStateMachineResources,
+        `arn:${options.partition}:wafv2:${edgeRegion}:${options.accountId}:global/webacl/*-${options.stage}-*/*`,
+    ].sort(compareStrings);
+    const namedProductionResources = [
+        `arn:${options.partition}:backup:${options.region}:${options.accountId}:backup-vault:*production*`,
+        `arn:${options.partition}:cloudwatch:${options.region}:${options.accountId}:alarm:*production*`,
+        `arn:${options.partition}:cloudwatch::${options.accountId}:dashboard/*production*`,
+        ...productionRouterCloudFrontFunctionResources,
+        `arn:${options.partition}:dynamodb:${options.region}:${options.accountId}:table/*-production-*`,
+        `arn:${options.partition}:ecr:${options.region}:${options.accountId}:repository/ebk/production/*`,
+        `arn:${options.partition}:ecs:${options.region}:${options.accountId}:cluster/*production*`,
+        `arn:${options.partition}:ecs:${options.region}:${options.accountId}:service/*production*/*`,
+        `arn:${options.partition}:elasticloadbalancing:${options.region}:${options.accountId}:loadbalancer/*/*production*/*`,
+        `arn:${options.partition}:elasticloadbalancing:${options.region}:${options.accountId}:targetgroup/*production*/*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:event-bus/*-production-*`,
+        `arn:${options.partition}:events:${options.region}:${options.accountId}:rule/*-production-*`,
+        `arn:${options.partition}:iam::${options.accountId}:instance-profile/ebk/production/*`,
+        `arn:${options.partition}:iam::${options.accountId}:policy/ebk/production/*`,
+        `arn:${options.partition}:iam::${options.accountId}:role/ebk/production/*`,
+        `arn:${options.partition}:kms:${options.region}:${options.accountId}:alias/ebk-production-*-data-export`,
+        `arn:${options.partition}:lambda:${options.region}:${options.accountId}:function:*-production-*`,
+        `arn:${options.partition}:logs:${options.region}:${options.accountId}:log-group:*production*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:cluster:*-production-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:db:*-production-*`,
+        `arn:${options.partition}:rds:${options.region}:${options.accountId}:snapshot:*-production-*`,
+        `arn:${options.partition}:s3:::*-production-*`,
+        `arn:${options.partition}:s3:::*-production-*/*`,
+        `arn:${options.partition}:secretsmanager:${options.region}:${options.accountId}:secret:ebk/production/*`,
+        `arn:${options.partition}:sns:${options.region}:${options.accountId}:*-production-*`,
+        `arn:${options.partition}:sqs:${options.region}:${options.accountId}:*-production-*`,
+        `arn:${options.partition}:ssm:${options.region}:${options.accountId}:parameter/*production*`,
+        `arn:${options.partition}:states:${options.region}:${options.accountId}:stateMachine:*-production-*`,
+        `arn:${options.partition}:wafv2:${edgeRegion}:${options.accountId}:global/webacl/*-production-*/*`,
+    ].sort(compareStrings);
+    const stageAndSharedSstBucketResources = [
+        `arn:${options.partition}:s3:::*-${options.stage}-*`,
+        `arn:${options.partition}:s3:::sst-asset-*`,
+        `arn:${options.partition}:s3:::sst-state-*`,
+    ].sort(compareStrings);
+    const runInstancesExternalReferenceResources = [
+        `arn:${options.partition}:ec2:${options.region}::image/ami-*`,
+        `arn:${options.partition}:ec2:${options.region}::snapshot/snap-*`,
+    ].sort(compareStrings);
+    const runInstancesApprovedReferenceOwners = [
+        options.accountId,
+        ...(options.stage === 'production'
+            ? []
+            : exports.STAGE_AUTHORITY_SST_417_EXTERNAL_AMI_OWNERS_BY_PARTITION[options.partition]),
+    ].sort(compareStrings);
+    const statements = [
+        statement({
+            Action: exports.STAGE_AUTHORITY_REGIONAL_READ_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadFixedRegionalServiceFamilies',
+        }),
+        statement({
+            Action: ['acm:Describe*', 'acm:Get*', 'acm:List*'],
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadEdgeCertificateControlPlane',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_OBSERVABILITY_READ_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadEdgeObservabilityControlPlane',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: stageRouterWafLogDestinationResources,
+            Sid: 'ManageOnlyGeneratedEdgeWafLogGroup',
+        }),
+        // CloudWatch Logs models these native WAF delivery calls as account-level
+        // operations. PutResourcePolicy exposes neither a resource ARN nor an
+        // action-specific condition key; reviewed generated source is the control
+        // for its uninspectable payload, and the request remains edge-Region-bound.
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ManageEdgeWafLogDeliveryControlPlane',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_GLOBAL_READ_ACTIONS,
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'ReadFixedGlobalServiceFamilies',
+        }),
+        statement({
+            Action: ['states:DescribeExecution'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: accountExecutionResources,
+            Sid: 'DescribeOnlyTaggedStageWorkflowExecutions',
+        }),
+        statement({
+            Action: ['states:DescribeExecution'],
+            Condition: {
+                StringNotEquals: {
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Deny',
+            Resource: accountExecutionResources,
+            Sid: 'DenyWorkflowExecutionReadWithoutStageTag',
+        }),
+        statement({
+            Action: ['states:DescribeExecution'],
+            Effect: 'Deny',
+            NotResource: accountExecutionResources,
+            Sid: 'DenyWorkflowExecutionReadOutsideAccount',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_REGIONAL_WRITE_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+                StringEqualsIfExists: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                    'aws:ResourceAccount': options.accountId,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateFixedRegionalServiceFamilies',
+        }),
+        statement({
+            Action: ['acm:*'],
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+                StringEqualsIfExists: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                    'aws:ResourceAccount': options.accountId,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateEdgeCertificates',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateStageBucketsInStageRegion',
+        }),
+        statement({
+            Action: ['s3:CreateBucket'],
+            Condition: options.region === 'us-east-1'
+                ? {
+                    Null: { 's3:LocationConstraint': 'true' },
+                    StringEquals: { 'aws:RequestedRegion': options.region },
+                }
+                : {
+                    StringEquals: {
+                        'aws:RequestedRegion': options.region,
+                        's3:LocationConstraint': options.region,
+                    },
+                },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateBucketOnlyInStageRegion',
+        }),
+        // The generated architecture does not synthesize a stable Grant resource
+        // whose grantee and operation set can be enumerated here. Follow AWS KMS's
+        // integrated-service contract instead: a user cannot call CreateGrant
+        // directly, and the grant remains bound to this account's stage key.
+        statement({
+            Action: ['kms:CreateGrant'],
+            Condition: {
+                Bool: { 'kms:GrantIsForAWSResource': 'true' },
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+                StringEqualsIfExists: {
+                    'aws:ResourceAccount': options.accountId,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageKmsKeyResources,
+            Sid: 'CreateOnlyAwsResourceKmsGrants',
+        }),
+        statement({
+            Action: ['ec2:RunInstances'],
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'LaunchStageInfrastructureFromApprovedReferences',
+        }),
+        statement({
+            Action: SECRET_BATCH_VALUE_READ_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenySecretsManagerBatchValueReads',
+        }),
+        statement({
+            Action: GENERATED_FOUNDATION_DATABASE_VALUE_ACTIONS,
+            Effect: 'Deny',
+            NotResource: generatedFoundationDatabaseCredentialResources,
+            Sid: 'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
+        }),
+        statement({
+            Action: GENERATED_FOUNDATION_DATABASE_RECONCILIATION_ACTIONS,
+            Condition: {
+                StringNotEquals: {
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Deny',
+            Resource: generatedFoundationDatabaseCredentialResources,
+            Sid: 'DenyGeneratedDatabaseValueAccessWithWrongStageTag',
+        }),
+        statement({
+            Action: STAGE_SECRET_CONTAINER_METADATA_UPDATE_ACTIONS,
+            Effect: 'Deny',
+            NotResource: stageSecretContainerMetadataUpdateResources,
+            Sid: 'DenySecretMetadataUpdateOutsideStageContainers',
+        }),
+        statement({
+            Action: ['ssm:GetParameter', 'ssm:GetParameters'],
+            Effect: 'Deny',
+            NotResource: stageReadableSsmValueResources,
+            Sid: 'DenyUnapprovedSsmValueReads',
+        }),
+        statement({
+            Action: SSM_HISTORY_AND_RECURSIVE_VALUE_READ_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenySsmHistoryAndRecursiveValueReads',
+        }),
+        statement({
+            Action: [
+                'ssm:AddTagsToResource',
+                'ssm:DeleteParameter',
+                'ssm:DeleteParameters',
+                'ssm:LabelParameterVersion',
+                'ssm:PutParameter',
+                'ssm:RemoveTagsFromResource',
+                'ssm:UnlabelParameterVersion',
+            ],
+            Effect: 'Deny',
+            Resource: immutableWorkspaceOwnerResources,
+            Sid: 'DenyOwnerMutation',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_NON_DEPLOYMENT_ACCOUNT_AND_DATA_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonDeploymentControlOperations',
+        }),
+        statement({
+            Action: WORKFLOW_EXECUTION_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            NotResource: [
+                ...accountExecutionResources,
+                ...accountStateMachineResources,
+            ],
+            Sid: 'DenyUnscopedWorkflowExecutionMutation',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNSUPPORTED_WORKFLOW_EXECUTION_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnsupportedWorkflowExecutionMutation',
+        }),
+        statement({
+            Action: ['states:StartExecution'],
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            Resource: accountStateMachineResources,
+            Sid: 'DenyUntaggedWorkflowExecutionStart',
+        }),
+        statement({
+            Action: ['states:StartExecution'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: accountStateMachineResources,
+            Sid: 'StartOnlyTaggedStageWorkflowExecutions',
+        }),
+        statement({
+            Action: ['cloudformation:CreateStack'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: machineAuthorizationStackResources,
+            Sid: 'CreateTaggedMachineAuthorizationStacks',
+        }),
+        statement({
+            Action: ['cloudformation:DeleteStack', 'cloudformation:UpdateStack'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: machineAuthorizationStackResources,
+            Sid: 'MutateTaggedMachineAuthorizationStacks',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: eventArchiveResources,
+            Sid: 'CreateNamedFoundationEventArchive',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: foundationEventBusResources,
+            Sid: 'CreateArchiveFromTaggedFoundationEventBus',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: eventArchiveResources,
+            Sid: 'MutateNamedFoundationEventArchive',
+        }),
+        statement({
+            Action: [
+                ...exports.STAGE_AUTHORITY_EVENT_ARCHIVE_CREATE_ACTIONS,
+                ...exports.STAGE_AUTHORITY_EVENT_ARCHIVE_RESOURCE_ACTIONS,
+            ],
+            Effect: 'Deny',
+            NotResource: [...eventArchiveResources, ...foundationEventBusResources],
+            Sid: 'DenyEventArchiveMutationOutsideGeneratedFoundationArchive',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_KMS_ROTATION_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageKmsKeyResources,
+            Sid: 'EnableRotationOnStageKmsKeys',
+        }),
+        statement({
+            Action: ['iam:CreateServiceLinkedRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:AWSServiceName': exports.STAGE_AUTHORITY_SERVICE_LINKED_ROLES.map(({ serviceName }) => serviceName),
+                },
+            },
+            Effect: 'Allow',
+            Resource: serviceLinkedRoleResources,
+            Sid: 'CreateOnlyRequiredServiceLinkedRoles',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateOnlyGeneratedCloudFrontResources',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_GLOBAL_WRITE_ACTIONS,
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateFixedGlobalServiceFamilies',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'MutateCloudFrontScopeWafInEdgeRegion',
+        }),
+        statement({
+            Action: ['route53:CreateHostedZone'],
+            Condition: {
+                Bool: { 'aws:ViaAWSService': 'true' },
+                StringEquals: {
+                    'aws:CalledViaLast': 'servicediscovery.amazonaws.com',
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateOnlyCloudMapPrivateHostedZones',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Allow',
+            Resource: [
+                `arn:${options.partition}:cloudfront::${options.accountId}:*/*`,
+            ],
+            Sid: 'MutateAccountCloudFront',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': edgeRegion,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageCloudFrontDistributionResources,
+            Sid: 'InvalidateOnlyStageCloudFrontDistributions',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_LAMBDA_DEPLOYMENT_INVOKE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'InvokeOnlyStageLambdaFunctions',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'lambda:Principal': LAMBDA_INTEGRATION_PRINCIPALS,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'AddOnlyReviewedStageLambdaIntegrations',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'lambda:FunctionUrlAuthType': 'NONE',
+                    'lambda:Principal': '*',
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'AddOnlyPublicStageLambdaFunctionUrlAccess',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                // AddPermission accepts InvokedViaFunctionUrl, but Lambda does not
+                // expose that request member as a caller-side authorization context.
+                // The companion request is distinguishable from the public
+                // InvokeFunctionUrl permission by the absence of FunctionUrlAuthType.
+                Null: {
+                    'lambda:FunctionUrlAuthType': 'true',
+                },
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'lambda:Principal': '*',
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'AddOnlyPublicStageLambdaFunctionUrlInvoke',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS,
+            Condition: {
+                ArnLike: {
+                    'wafv2:LogDestinationResource': stageRouterWafLogDestinationResources,
+                },
+                StringEquals: {
+                    'aws:RequestedRegion': edgeRegion,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                    'wafv2:LogScope': 'CUSTOMER',
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageRouterWebAclResources,
+            Sid: 'PutOnlyStageRouterWafLogging',
+        }),
+        statement({
+            Action: ['budgets:ModifyBudget', 'budgets:TagResource'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageAccountBudgetResources,
+            Sid: 'CreateOnlyTaggedStageAccountBudget',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_BUDGET_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageAccountBudgetResources,
+            Sid: 'MutateOnlyTaggedStageAccountBudget',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            Resource: productionEventSubscriptionResources,
+            Sid: 'DenyUnscopedDatabaseEventSubscriptionSourceMutation',
+        }),
+        statement({
+            Action: ['lambda:RemovePermission'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageLambdaResources,
+            Sid: 'RemoveOnlyStageLambdaIntegrations',
+        }),
+        statement({
+            Action: ['lambda:AddPermission', 'lambda:RemovePermission'],
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnscopedLambdaPermissions',
+        }),
+        statement({
+            Action: ['sns:SetTopicAttributes'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageTopicResources,
+            Sid: 'SetOnlyStageTopicAttributes',
+        }),
+        // RDS validates that the CreateEventSubscription caller can publish to
+        // its destination topic. The regional service-family allow admits that
+        // control-plane check; this exact deny keeps every other topic closed.
+        // Runtime workloads retain their separately generated least-privilege roles.
+        statement({
+            Action: ['sns:Publish'],
+            Effect: 'Deny',
+            NotResource: generatedFoundationAlertTopicResources,
+            Sid: 'DenyPublishOutsideGeneratedFoundationAlerts',
+        }),
+        statement({
+            Action: ['sqs:SetQueueAttributes'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageQueueResources,
+            Sid: 'SetOnlyStageQueueAttributes',
+        }),
+        statement({
+            Action: ['sns:SetTopicAttributes'],
+            Effect: 'Deny',
+            NotResource: stageTopicResources,
+            Sid: 'DenyTopicAttributeMutationOutsideStage',
+        }),
+        statement({
+            Action: ['sqs:SetQueueAttributes'],
+            Effect: 'Deny',
+            NotResource: stageQueueResources,
+            Sid: 'DenyQueueAttributeMutationOutsideStage',
+        }),
+        statement({
+            Action: [
+                'iam:AddRoleToInstanceProfile',
+                'iam:CreateInstanceProfile',
+                'iam:DeleteInstanceProfile',
+                'iam:DeleteRole',
+                'iam:DeleteRolePolicy',
+                'iam:PutRolePolicy',
+                'iam:RemoveRoleFromInstanceProfile',
+                'iam:TagInstanceProfile',
+                'iam:TagRole',
+                'iam:UntagInstanceProfile',
+                'iam:UntagRole',
+                'iam:UpdateRole',
+                'iam:UpdateRoleDescription',
+            ],
+            Effect: 'Allow',
+            Resource: [
+                options.identity.workloadInstanceProfileArnPattern,
+                options.identity.workloadRoleArnPattern,
+            ],
+            Sid: 'ManageStageWorkloadIdentities',
+        }),
+        statement({
+            Action: ['iam:CreateRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'CreateOnlyBoundaryConstrainedStageWorkloadRoles',
+        }),
+        statement({
+            Action: ['iam:PutRolePermissionsBoundary'],
+            Condition: {
+                StringEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'ApplyExactStageRuntimeBoundary',
+        }),
+        statement({
+            Action: ['iam:AttachRolePolicy', 'iam:DetachRolePolicy'],
+            Condition: {
+                ArnEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                    'iam:PolicyARN': managedPolicies,
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'AttachOnlyPinnedAwsRuntimePolicies',
+        }),
+        statement({
+            Action: ['iam:PassRole'],
+            Condition: {
+                StringEquals: {
+                    'iam:PassedToService': [
+                        'appconfig.amazonaws.com',
+                        'ec2.amazonaws.com',
+                        'ecs-tasks.amazonaws.com',
+                        'lambda.amazonaws.com',
+                        'states.amazonaws.com',
+                    ].sort(compareStrings),
+                },
+            },
+            Effect: 'Allow',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'PassOnlyStageWorkloadRoles',
+        }),
+        statement({
+            Action: ['iam:PassRole'],
+            Condition: {
+                StringNotEquals: {
+                    'iam:PassedToService': 'ec2.amazonaws.com',
+                },
+            },
+            Effect: 'Deny',
+            Resource: foundationNatWorkloadRoleResources,
+            Sid: 'DenyFoundationNatRolePassOutsideEc2',
+        }),
+        statement({
+            Action: PRIVILEGE_CONSTRUCTION_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyAccountAndPrivilegeAdministration',
+        }),
+        statement({
+            Action: RESOURCE_POLICY_AND_TRUST_EXPANSION_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnreviewableResourcePolicyAndTrustExpansion',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNSUPPORTED_REPLICATION_AND_TOPOLOGY_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyUnsupportedReplicationAndTopology',
+        }),
+        statement({
+            Action: [
+                'servicediscovery:CreateHttpNamespace',
+                'servicediscovery:CreatePublicDnsNamespace',
+            ],
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonPrivateServiceDiscoveryNamespaces',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_S3_BUCKET_POLICY_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            NotResource: stageAndSharedSstBucketResources,
+            Sid: 'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
+        }),
+        statement({
+            Action: ['lambda:AddPermission'],
+            Condition: {
+                StringNotEquals: {
+                    'lambda:Principal': REVIEWED_LAMBDA_PERMISSION_PRINCIPALS,
+                },
+            },
+            Effect: 'Deny',
+            Resource: stageLambdaResources,
+            Sid: 'DenyUnreviewedLambdaIntegrationPrincipal',
+        }),
+        statement({
+            Action: ['budgets:UntagResource'],
+            Condition: {
+                'ForAnyValue:StringEquals': {
+                    'aws:TagKeys': 'ebk:stage',
+                },
+            },
+            Effect: 'Deny',
+            Resource: stageAccountBudgetResources,
+            Sid: 'DenyStageAccountBudgetStageTagRemoval',
+        }),
+        statement({
+            Action: IAM_AUTHORITY_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            Resource: [
+                options.identity.boundaryArn,
+                ...options.identity.deploymentPolicyArns,
+                options.identity.deploymentRoleArn,
+            ],
+            Sid: 'DenyStageAuthorityMutation',
+        }),
+        statement({
+            Action: ['iam:DeleteRolePermissionsBoundary'],
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyRuntimeBoundaryRemoval',
+        }),
+        statement({
+            Action: ['iam:UpdateAssumeRolePolicy'],
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyRuntimeTrustPolicyMutation',
+        }),
+        statement({
+            Action: ['iam:PutRolePermissionsBoundary'],
+            Condition: {
+                ArnNotEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyRuntimeBoundarySubstitution',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_WORKLOAD_IDENTITY_POLICY_ACTIONS,
+            Condition: {
+                ArnNotEquals: {
+                    'iam:PermissionsBoundary': options.identity.boundaryArn,
+                },
+            },
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyUnboundedStageWorkloadIdentityPolicyMutation',
+        }),
+        statement({
+            Action: ['iam:AttachRolePolicy'],
+            Condition: {
+                ArnNotEquals: { 'iam:PolicyARN': managedPolicies },
+            },
+            Effect: 'Deny',
+            Resource: [options.identity.workloadRoleArnPattern],
+            Sid: 'DenyUnapprovedManagedPolicyAttachment',
+        }),
+        statement({
+            Action: ['acm:*'],
+            Condition: {
+                StringNotEquals: {
+                    'aws:RequestedRegion': [options.region, edgeRegion],
+                },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyAcmMutationOutsideStageAndEdgeRegions',
+        }),
+        statement({
+            Action: [
+                ...exports.STAGE_AUTHORITY_S3_REGIONAL_MUTATION_ACTIONS,
+                's3:CreateBucket',
+            ],
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyS3MutationOutsideStageRegion',
+        }),
+        statement({
+            Action: [
+                ...exports.STAGE_AUTHORITY_ACCOUNT_SCOPED_GLOBAL_WRITE_ACTIONS,
+                ...exports.STAGE_AUTHORITY_CLOUDFRONT_INVALIDATION_ACTIONS,
+                ...exports.STAGE_AUTHORITY_EDGE_WAF_LOG_DELIVERY_MUTATION_ACTIONS,
+                ...exports.STAGE_AUTHORITY_UNSCOPED_CLOUDFRONT_CREATE_ACTIONS,
+                ...exports.STAGE_AUTHORITY_WAF_EDGE_MUTATION_ACTIONS,
+                ...exports.STAGE_AUTHORITY_WAF_LOGGING_ACTIONS,
+            ],
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyEdgeControlMutationOutsideEdgeRegion',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_REGIONAL_MUTATION_FAMILIES,
+            Condition: {
+                StringNotEquals: { 'aws:RequestedRegion': options.region },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyMutationOutsideStageRegion',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_LOGS_MUTATION_FAMILIES,
+            Condition: {
+                StringNotEquals: {
+                    'aws:RequestedRegion': [options.region, edgeRegion],
+                },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyLogsMutationOutsideStageAndEdgeRegions',
+        }),
+        // When the application and CloudFront edge control planes share a Region,
+        // RequestedRegion cannot distinguish their log groups. In that case admit
+        // only the generated application and API execution-log namespaces so both
+        // create-time and existing-resource lifecycle calls remain bounded.
+        statement({
+            Action: exports.STAGE_AUTHORITY_EDGE_WAF_LOG_GROUP_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:RequestedRegion': edgeRegion },
+            },
+            Effect: 'Deny',
+            NotResource: generatedEdgeLogGroupMutationResources,
+            Sid: 'DenyEdgeLogGroupMutationOutsideGeneratedStageLogs',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_CROSS_ACCOUNT_MUTATION_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceAccount': 'false' },
+                StringNotEquals: { 'aws:ResourceAccount': options.accountId },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyCrossAccountMutationWhenResourceAccountIsKnown',
+        }),
+        statement({
+            Action: ['ec2:RunInstances'],
+            Condition: {
+                Null: { 'aws:ResourceAccount': 'false' },
+                StringNotEquals: { 'aws:ResourceAccount': options.accountId },
+            },
+            Effect: 'Deny',
+            NotResource: runInstancesExternalReferenceResources,
+            Sid: 'DenyCrossAccountRunInstancesTargets',
+        }),
+        statement({
+            Action: ['ec2:RunInstances'],
+            Condition: {
+                StringNotEquals: {
+                    'ec2:Owner': runInstancesApprovedReferenceOwners,
+                },
+            },
+            Effect: 'Deny',
+            Resource: runInstancesExternalReferenceResources,
+            Sid: 'DenyRunInstancesFromUnapprovedReferenceOwners',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'false' },
+                StringNotEquals: { 'aws:ResourceTag/ebk:stage': options.stage },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyKnownOtherStageResourceMutation',
+        }),
+        statement({
+            Action: exports.STAGE_AUTHORITY_UNTAGGED_DESTRUCTIVE_ACTIONS,
+            Condition: {
+                Null: { 'aws:ResourceTag/ebk:stage': 'true' },
+            },
+            Effect: 'Deny',
+            NotResource: stageAndSharedMutationResources,
+            Sid: 'DenyUntaggedMutationOutsideStageAndSstResources',
+        }),
+        statement({
+            Action: ['*'],
+            Condition: {
+                Null: { 'aws:RequestTag/ebk:stage': 'false' },
+                StringNotEquals: { 'aws:RequestTag/ebk:stage': options.stage },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyExplicitOtherStageRequestTag',
+        }),
+    ];
+    if (options.stage !== 'production') {
+        statements.push(statement({
+            Action: ['kms:ScheduleKeyDeletion'],
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:management': 'standard-data-export',
+                    'aws:ResourceTag/ebk:stage': options.stage,
+                },
+            },
+            Effect: 'Allow',
+            Resource: stageKmsKeyResources,
+            Sid: 'RetireOnlyTaggedNonProductionKmsKeys',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS,
+            Condition: {
+                StringEquals: { 'aws:ResourceTag/ebk:stage': 'production' },
+            },
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonProductionAccessToProductionTaggedResources',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_KNOWN_STAGE_MUTATION_ACTIONS,
+            Effect: 'Deny',
+            Resource: namedProductionResources,
+            Sid: 'DenyNonProductionAccessToNamedProductionResources',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS,
+            Effect: 'Deny',
+            Resource: ['*'],
+            Sid: 'DenyNonProductionDatabaseEventSubscriptionSourceMutation',
+        }));
+    }
+    if (options.stage === 'production') {
+        statements.push(statement({
+            Action: ['kms:ScheduleKeyDeletion'],
+            Effect: 'Deny',
+            Resource: stageKmsKeyResources,
+            Sid: 'DenyProtectedProductionKmsKeyDeletion',
+        }), statement({
+            Action: ['kms:DeleteAlias'],
+            Effect: 'Deny',
+            Resource: productionDataExportAliasResources,
+            Sid: 'DenyProtectedProductionDataExportAliasDeletion',
+        }), statement({
+            Action: [
+                's3:DeleteBucket',
+                's3:DeleteBucketPolicy',
+                's3:DeleteObject',
+                's3:DeleteObjectVersion',
+            ],
+            Effect: 'Deny',
+            Resource: productionDataExportBucketResources,
+            Sid: 'DenyProtectedProductionDataExportDeletion',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_RDS_EVENT_SUBSCRIPTION_SOURCE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestedRegion': options.region,
+                    'aws:ResourceTag/ebk:stage': 'production',
+                },
+            },
+            Effect: 'Allow',
+            Resource: productionEventSubscriptionResources,
+            Sid: 'MutateOnlyProductionDatabaseEventSubscriptionSources',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_COST_ANOMALY_READ_ACTIONS,
+            Condition: {
+                StringLike: {
+                    'aws:ResourceTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Allow',
+            Resource: costAnomalyResources,
+            Sid: 'ReadProductionCostAnomalyControl',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_COST_ANOMALY_CREATE_ACTIONS,
+            Condition: {
+                StringEquals: {
+                    'aws:RequestTag/ebk:stage': options.stage,
+                },
+                StringLike: {
+                    'aws:RequestTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Allow',
+            Resource: ['*'],
+            Sid: 'CreateProductionCostAnomalyControl',
+        }), statement({
+            Action: exports.STAGE_AUTHORITY_COST_ANOMALY_RESOURCE_WRITE_ACTIONS,
+            Condition: {
+                StringLike: {
+                    'aws:ResourceTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Allow',
+            Resource: costAnomalyResources,
+            Sid: 'MutateProductionCostAnomalyControl',
+        }), statement({
+            Action: ['ce:TagResource'],
+            Condition: {
+                Null: { 'aws:RequestTag/ebk:cost-scope': 'false' },
+                StringNotLike: {
+                    'aws:RequestTag/ebk:cost-scope': productionCostScope,
+                },
+            },
+            Effect: 'Deny',
+            Resource: costAnomalyResources,
+            Sid: 'DenyProductionCostScopeSubstitution',
+        }), statement({
+            Action: ['ce:UntagResource'],
+            Condition: {
+                'ForAnyValue:StringEquals': {
+                    'aws:TagKeys': 'ebk:cost-scope',
+                },
+            },
+            Effect: 'Deny',
+            Resource: costAnomalyResources,
+            Sid: 'DenyProductionCostScopeRemoval',
+        }), statement({
+            Action: [
+                'backup:DeleteRecoveryPoint',
+                'rds:DeleteDBCluster',
+                'rds:DeleteDBClusterAutomatedBackup',
+                'rds:DeleteDBInstance',
+                'rds:DeleteDBSnapshot',
+            ],
+            Effect: 'Deny',
+            Resource: productionDatabaseResources,
+            Sid: 'DenyProtectedProductionDatabaseDeletion',
+        }), statement({
+            Action: [
+                'backup:DeleteBackupPlan',
+                'backup:DeleteBackupSelection',
+                'backup:DeleteBackupVault',
+                'backup:DeleteRecoveryPoint',
+            ],
+            Effect: 'Deny',
+            Resource: productionRetentionResources,
+            Sid: 'DenyProtectedProductionRetentionDeletion',
+        }));
+    }
+    const groups = [
+        {
+            kind: 'read',
+            logicalId: 'StageDeploymentReadPolicy',
+            sids: [
+                'DenyGeneratedDatabaseValueAccessWithWrongStageTag',
+                'DenyNonPrivateServiceDiscoveryNamespaces',
+                'DenyRuntimeBoundaryRemoval',
+                'DenySecretsManagerBatchValueReads',
+                'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
+                'DenySsmHistoryAndRecursiveValueReads',
+                'DenyWorkflowExecutionReadOutsideAccount',
+                'DenyUnapprovedSsmValueReads',
+                'CreateOnlyAwsResourceKmsGrants',
+                'ManageEdgeWafLogDeliveryControlPlane',
+                'ManageOnlyGeneratedEdgeWafLogGroup',
+                'PutOnlyStageRouterWafLogging',
+                'ReadFixedGlobalServiceFamilies',
+                'ReadFixedRegionalServiceFamilies',
+                'DenyWorkflowExecutionReadWithoutStageTag',
+                'DescribeOnlyTaggedStageWorkflowExecutions',
+                ...(options.stage === 'production'
+                    ? ['ReadProductionCostAnomalyControl']
+                    : []),
+            ],
+        },
+        {
+            kind: 'regional-mutation',
+            logicalId: 'StageDeploymentRegionalMutationPolicy',
+            sids: [
+                'CreateOnlyCloudMapPrivateHostedZones',
+                'CreateBucketOnlyInStageRegion',
+                'DenyAcmMutationOutsideStageAndEdgeRegions',
+                'DenyEdgeControlMutationOutsideEdgeRegion',
+                'DenyMutationOutsideStageRegion',
+                'DenyS3MutationOutsideStageRegion',
+                'DenySecretMetadataUpdateOutsideStageContainers',
+                'DenyUnscopedWorkflowExecutionMutation',
+                'InvokeOnlyStageLambdaFunctions',
+                'MutateEdgeCertificates',
+                'MutateFixedRegionalServiceFamilies',
+                'MutateStageBucketsInStageRegion',
+            ],
+        },
+        {
+            kind: 'global-iam-mutation',
+            logicalId: 'StageDeploymentGlobalIamMutationPolicy',
+            sids: [
+                'AddOnlyReviewedStageLambdaIntegrations',
+                'ApplyExactStageRuntimeBoundary',
+                'AttachOnlyPinnedAwsRuntimePolicies',
+                'CreateOnlyBoundaryConstrainedStageWorkloadRoles',
+                'DenyFoundationNatRolePassOutsideEc2',
+                'DenyQueueAttributeMutationOutsideStage',
+                'DenyStageAuthorityMutation',
+                'DenyTopicAttributeMutationOutsideStage',
+                'DenyUnscopedLambdaPermissions',
+                'ManageStageWorkloadIdentities',
+                'PassOnlyStageWorkloadRoles',
+                'RemoveOnlyStageLambdaIntegrations',
+                'SetOnlyStageQueueAttributes',
+                'SetOnlyStageTopicAttributes',
+            ],
+        },
+        {
+            kind: 'global-resource-mutation',
+            logicalId: 'StageDeploymentGlobalResourceMutationPolicy',
+            sids: [
+                'DenyCrossAccountMutationWhenResourceAccountIsKnown',
+                'DenyCrossAccountRunInstancesTargets',
+                'DenyLogsMutationOutsideStageAndEdgeRegions',
+                'DenyRunInstancesFromUnapprovedReferenceOwners',
+                'DenyUnsupportedReplicationAndTopology',
+                'LaunchStageInfrastructureFromApprovedReferences',
+                'MutateAccountCloudFront',
+                'MutateCloudFrontScopeWafInEdgeRegion',
+                'MutateFixedGlobalServiceFamilies',
+                'CreateOnlyTaggedStageAccountBudget',
+                'DenyStageAccountBudgetStageTagRemoval',
+                'MutateOnlyTaggedStageAccountBudget',
+            ],
+        },
+        {
+            kind: 'generated-resource-mutation',
+            logicalId: 'StageDeploymentGeneratedResourceMutationPolicy',
+            sids: [
+                'AddOnlyPublicStageLambdaFunctionUrlAccess',
+                'AddOnlyPublicStageLambdaFunctionUrlInvoke',
+                'CreateOnlyRequiredServiceLinkedRoles',
+                'CreateArchiveFromTaggedFoundationEventBus',
+                'CreateNamedFoundationEventArchive',
+                'CreateTaggedMachineAuthorizationStacks',
+                'DenyPublishOutsideGeneratedFoundationAlerts',
+                'EnableRotationOnStageKmsKeys',
+                'InvalidateOnlyStageCloudFrontDistributions',
+                'MutateNamedFoundationEventArchive',
+                'MutateTaggedMachineAuthorizationStacks',
+                'DenyOwnerMutation',
+                ...(options.stage !== 'production'
+                    ? ['RetireOnlyTaggedNonProductionKmsKeys']
+                    : []),
+                'DenyUntaggedWorkflowExecutionStart',
+                'StartOnlyTaggedStageWorkflowExecutions',
+                ...(options.stage === 'production'
+                    ? [
+                        'CreateProductionCostAnomalyControl',
+                        'DenyProductionCostScopeRemoval',
+                        'DenyProductionCostScopeSubstitution',
+                        'MutateOnlyProductionDatabaseEventSubscriptionSources',
+                        'MutateProductionCostAnomalyControl',
+                    ]
+                    : []),
+            ],
+        },
+        {
+            kind: 'stage-containment',
+            logicalId: 'StageDeploymentStageContainmentPolicy',
+            sids: [
+                'CreateOnlyGeneratedCloudFrontResources',
+                'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
+                'DenyEventArchiveMutationOutsideGeneratedFoundationArchive',
+                'DenyExplicitOtherStageRequestTag',
+                'DenyKnownOtherStageResourceMutation',
+                ...(options.stage !== 'production'
+                    ? ['DenyNonProductionDatabaseEventSubscriptionSourceMutation']
+                    : []),
+                'DenyRuntimeTrustPolicyMutation',
+                'DenyUnscopedDatabaseEventSubscriptionSourceMutation',
+                'DenyUntaggedMutationOutsideStageAndSstResources',
+            ],
+        },
+        {
+            kind: 'permission-guardrails',
+            logicalId: 'StageDeploymentPermissionGuardrailsPolicy',
+            sids: [
+                'DenyNonDeploymentControlOperations',
+                'DenyUnboundedStageWorkloadIdentityPolicyMutation',
+                'DenyUnsupportedWorkflowExecutionMutation',
+                'DenyUnreviewableResourcePolicyAndTrustExpansion',
+            ],
+        },
+        {
+            kind: 'guardrails',
+            logicalId: 'StageDeploymentGuardrailsPolicy',
+            sids: [
+                ...statements
+                    .filter((entry) => entry.Sid.startsWith('Deny') &&
+                    ![
+                        'DenyCrossAccountMutationWhenResourceAccountIsKnown',
+                        'DenyCrossAccountRunInstancesTargets',
+                        'DenyEdgeControlMutationOutsideEdgeRegion',
+                        'DenyAcmMutationOutsideStageAndEdgeRegions',
+                        'DenyBucketPolicyMutationOutsideStageAndSstBootstrap',
+                        'DenyEventArchiveMutationOutsideGeneratedFoundationArchive',
+                        'DenyExplicitOtherStageRequestTag',
+                        'DenyFoundationNatRolePassOutsideEc2',
+                        'DenyGeneratedDatabaseValueAccessWithWrongStageTag',
+                        'DenyKnownOtherStageResourceMutation',
+                        'DenyLogsMutationOutsideStageAndEdgeRegions',
+                        'DenyMutationOutsideStageRegion',
+                        'DenyNonDeploymentControlOperations',
+                        'DenyNonPrivateServiceDiscoveryNamespaces',
+                        'DenyOwnerMutation',
+                        'DenyNonProductionDatabaseEventSubscriptionSourceMutation',
+                        'DenyProductionCostScopeRemoval',
+                        'DenyProductionCostScopeSubstitution',
+                        'DenyPublishOutsideGeneratedFoundationAlerts',
+                        'DenyQueueAttributeMutationOutsideStage',
+                        'DenyRuntimeBoundaryRemoval',
+                        'DenyRuntimeTrustPolicyMutation',
+                        'DenySecretsManagerBatchValueReads',
+                        'DenySecretMetadataUpdateOutsideStageContainers',
+                        'DenySecretValueAccessOutsideGeneratedFoundationDatabase',
+                        'DenySsmHistoryAndRecursiveValueReads',
+                        'DenyStageAccountBudgetStageTagRemoval',
+                        'DenyStageAuthorityMutation',
+                        'DenyTopicAttributeMutationOutsideStage',
+                        'DenyUnapprovedSsmValueReads',
+                        'DenyUnreviewableResourcePolicyAndTrustExpansion',
+                        'DenyUnscopedDatabaseEventSubscriptionSourceMutation',
+                        'DenyUnscopedLambdaPermissions',
+                        'DenyUnboundedStageWorkloadIdentityPolicyMutation',
+                        'DenyUnscopedWorkflowExecutionMutation',
+                        'DenyUnsupportedWorkflowExecutionMutation',
+                        'DenyUntaggedWorkflowExecutionStart',
+                        'DenyUntaggedMutationOutsideStageAndSstResources',
+                        'DenyWorkflowExecutionReadWithoutStageTag',
+                        'DenyWorkflowExecutionReadOutsideAccount',
+                        'DenyRunInstancesFromUnapprovedReferenceOwners',
+                        'DenyUnsupportedReplicationAndTopology',
+                        'DenyS3MutationOutsideStageRegion',
+                    ].includes(entry.Sid))
+                    .map((entry) => entry.Sid),
+                'ReadEdgeCertificateControlPlane',
+                'ReadEdgeObservabilityControlPlane',
+            ],
+        },
+    ];
+    const assigned = new Set(groups.flatMap((group) => group.sids));
+    const assignmentCount = groups.reduce((total, group) => total + group.sids.length, 0);
+    const unassigned = statements.filter((entry) => !assigned.has(entry.Sid));
+    if (unassigned.length > 0 ||
+        assigned.size !== statements.length ||
+        assignmentCount !== statements.length) {
+        throw new Error(`Stage authority policy groups must assign every statement exactly once; unassigned: ${unassigned.map((entry) => entry.Sid).join(', ') ||
+            'duplicate assignment'}.`);
+    }
+    return Object.freeze(groups.map((group, index) => {
+        const document = policy(statements.filter((entry) => group.sids.includes(entry.Sid)));
+        const characters = JSON.stringify(omitPolicyStatementSids(document)).length;
+        if (characters >
+            exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT -
+                exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM) {
+            throw new Error(`Stage authority ${group.kind} policy has ${characters} characters; it must retain ${exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_HEADROOM} characters below the IAM managed-policy limit of ${exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT}.`);
+        }
+        const name = options.identity.deploymentPolicyNames[index];
+        const arn = options.identity.deploymentPolicyArns[index];
+        if (!name || !arn) {
+            throw new Error(`Stage authority ${group.kind} identity is incomplete.`);
+        }
+        return Object.freeze({
+            arn,
+            document,
+            kind: group.kind,
+            logicalId: group.logicalId,
+            name,
+        });
+    }));
+}
+function canonicalStageAuthorityTemplate(template) {
+    return `${JSON.stringify(canonicalize(template))}\n`;
+}
+function digestStageAuthorityTemplate(template) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update(canonicalStageAuthorityTemplate(template), 'utf8')
+        .digest('hex');
+}
+function assertBoundStageAuthorityTemplateFitsBodyLimit(template) {
+    const templateBytes = Buffer.byteLength(canonicalStageAuthorityTemplate(template), 'utf8');
+    if (templateBytes > exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT) {
+        throw new Error(`Workspace-bound stage authority template has ${templateBytes} bytes; the direct CloudFormation TemplateBody limit is ${exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT}.`);
+    }
+    return templateBytes;
+}
+function createStageAuthorityPlan(input) {
+    const target = requireIdentity(input);
+    const identity = createStageAuthorityIdentity(target);
+    const assumeRolePolicy = requireTrust(input, target);
+    const boundary = runtimeBoundaryPolicy({
+        accountId: target.accountId,
+        identity,
+        region: target.region,
+        stage: target.stage,
+    });
+    const boundaryCharacters = JSON.stringify(omitPolicyStatementSids(boundary)).length;
+    if (boundaryCharacters > exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT) {
+        throw new Error(`Stage runtime boundary has ${boundaryCharacters} characters; the IAM managed-policy limit is ${exports.STAGE_AUTHORITY_MANAGED_POLICY_CHARACTER_LIMIT}.`);
+    }
+    const deployment = deploymentPolicy({
+        accountId: target.accountId,
+        identity,
+        partition: target.partition,
+        region: target.region,
+        stage: target.stage,
+    });
+    const renderedDeploymentPolicyDocuments = Object.fromEntries(deployment.map((entry) => {
+        let document = replaceExactTemplateString(replaceExactTemplateString(omitPolicyStatementSids(entry.document), identity.boundaryArn, { Ref: 'StageRuntimeBoundary' }), identity.deploymentRoleArn, { 'Fn::GetAtt': ['StageDeploymentRole', 'Arn'] });
+        if (entry.logicalId === 'StageDeploymentGlobalIamMutationPolicy') {
+            for (const sibling of deployment) {
+                if (sibling.logicalId === entry.logicalId)
+                    continue;
+                document = replaceExactTemplateString(document, sibling.arn, {
+                    Ref: sibling.logicalId,
+                });
+            }
+        }
+        return [entry.logicalId, document];
+    }));
+    const edgeRegion = edgeControlRegion(target.partition, target.region);
+    const templatePolicyDocuments = compactExactTemplatePolicyStrings({
+        ...renderedDeploymentPolicyDocuments,
+        StageRuntimeBoundary: omitPolicyStatementSids(boundary),
+    }, [
+        identity.workloadRoleArnPattern,
+        `arn:${target.partition}:cloudformation:${target.region}:${target.accountId}:stack/*MachineAuthorization*/*`,
+        `arn:${target.partition}:events:${target.region}:${target.accountId}:archive/ebk-${target.stage}-foundation-events`,
+        `arn:${target.partition}:events:${target.region}:${target.accountId}:event-bus/foundation-${target.stage}-FoundationEventBusBus-*`,
+        `arn:${target.partition}:lambda:${target.region}:${target.accountId}:function:*`,
+        `arn:${target.partition}:logs:${edgeRegion}:${target.accountId}:log-group:aws-waf-logs-foundation-${target.stage}-FoundationRouter-*`,
+        `arn:${target.partition}:secretsmanager:${target.region}:${target.accountId}:secret:foundation-${target.stage}-FoundationDatabaseProxySecret-*`,
+        `arn:${target.partition}:states:${target.region}:${target.accountId}:execution:*:*`,
+    ]);
+    const deploymentPolicyResources = Object.fromEntries(deployment.map((entry) => [
+        entry.logicalId,
+        {
+            Properties: {
+                Description: `Stable reviewed ${target.stage} ${entry.kind} deployment authority.`,
+                ManagedPolicyName: entry.name,
+                Path: identity.deploymentRolePath,
+                // IAM statement Sids are diagnostic labels, not authority. Keep them
+                // in the executable policy model while omitting them from the direct
+                // CloudFormation body so every supported partition retains bounded
+                // TemplateBody headroom without changing effective permissions.
+                // Ref on AWS::IAM::ManagedPolicy resolves to its exact ARN. Use the
+                // runtime-boundary resource identity in rendered policy documents
+                // instead of repeating its long partition/account/path ARN. The
+                // executable policy model retains the literal ARN for simulation;
+                // this is representation-only direct-TemplateBody compaction.
+                PolicyDocument: templatePolicyDocuments.documents[entry.logicalId],
+                Roles: [{ Ref: 'StageDeploymentRole' }],
+            },
+            Type: 'AWS::IAM::ManagedPolicy',
+        },
+    ]));
+    const template = {
+        AWSTemplateFormatVersion: '2010-09-09',
+        ...(templatePolicyDocuments.mappings
+            ? { Mappings: templatePolicyDocuments.mappings }
+            : {}),
+        Outputs: {
+            DeploymentRoleArn: {
+                Value: { 'Fn::GetAtt': ['StageDeploymentRole', 'Arn'] },
+            },
+            RuntimeBoundaryArn: { Value: { Ref: 'StageRuntimeBoundary' } },
+        },
+        Resources: {
+            ...deploymentPolicyResources,
+            StageDeploymentRole: {
+                Properties: {
+                    AssumeRolePolicyDocument: omitPolicyStatementSids(assumeRolePolicy),
+                    Description: `Stable Empire Builder Kit ${target.stage} deployment role.`,
+                    MaxSessionDuration: 3_600,
+                    Path: identity.deploymentRolePath,
+                    RoleName: identity.deploymentRoleName,
+                    Tags: [
+                        { Key: 'ebk:managed-by', Value: 'empire-builder-kit' },
+                        { Key: 'ebk:stage', Value: target.stage },
+                    ],
+                },
+                Type: 'AWS::IAM::Role',
+            },
+            StageRuntimeBoundary: {
+                Properties: {
+                    Description: `Stable maximum permissions for ${target.stage} workload roles.`,
+                    ManagedPolicyName: identity.boundaryName,
+                    Path: identity.boundaryPath,
+                    PolicyDocument: templatePolicyDocuments.documents['StageRuntimeBoundary'],
+                },
+                Type: 'AWS::IAM::ManagedPolicy',
+            },
+        },
+    };
+    const templateBytes = Buffer.byteLength(canonicalStageAuthorityTemplate(template), 'utf8');
+    if (templateBytes > exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT) {
+        throw new Error(`Stage authority template has ${templateBytes} bytes; the direct CloudFormation TemplateBody limit is ${exports.STAGE_AUTHORITY_TEMPLATE_BODY_BYTE_LIMIT}.`);
+    }
+    return deepFreeze({
+        deploymentPolicies: deployment,
+        digest: digestStageAuthorityTemplate(template),
+        identity,
+        limitations: Object.freeze({
+            protectedDatabaseConfiguration: 'iam-cannot-inspect-rds-modify-request-fields-lifecycle-preflight-required',
+            resourcePolicyAttributes: 'sns-and-sqs-set-attributes-can-write-resource-policies-name-account-region-containment-applies',
+            sameAccountStageDeploymentIsolation: 'deployment-role-is-account-scoped-use-production-isolated-for-hard-production-boundary',
+            wafLoggingResourcePolicy: 'cloudwatch-logs-put-resource-policy-has-no-resource-or-action-condition-keys-reviewed-generated-source-is-control',
+            workloadTrust: 'iam-cannot-inspect-create-role-trust-reviewed-generated-source-is-control',
+        }),
+        runtimeBoundaryPolicy: boundary,
+        schemaVersion: exports.STAGE_AUTHORITY_SCHEMA_VERSION,
+        template,
+    });
+}
+function createStageIamBoundaryTransformContract(input) {
+    const identity = createStageAuthorityIdentity({
+        ...input,
+        region: 'us-east-1',
+    });
+    return Object.freeze({
+        boundaryArn: identity.boundaryArn,
+        instanceProfilePath: identity.workloadInstanceProfilePath,
+        rolePath: identity.workloadRolePath,
+    });
+}
+function requireTransformArgs(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} transform arguments must be an object.`);
+    }
+    return value;
+}
+function refuseSubstitution(existing, expected, label) {
+    if (existing !== undefined && existing !== expected) {
+        throw new Error(`${label} attempted to substitute stable stage authority.`);
+    }
+}
+/**
+ * Installs ordinary Pulumi resource transforms before generated SST components
+ * are constructed. SST remains responsible for creating its roles and NAT
+ * instance profiles; this helper contributes only the stable stage path and
+ * permissions boundary.
+ */
+function installStageIamBoundaryTransforms(input) {
+    if (typeof input.registerTransform !== 'function' ||
+        input.roleResource === undefined ||
+        input.instanceProfileResource === undefined) {
+        throw new Error('Stage IAM boundary transforms require the ordinary Pulumi role and instance-profile resource types.');
+    }
+    const contract = createStageIamBoundaryTransformContract(input);
+    input.registerTransform(input.roleResource, (value) => {
+        const args = requireTransformArgs(value, 'IAM role');
+        refuseSubstitution(args.permissionsBoundary, contract.boundaryArn, 'IAM role permissions boundary');
+        refuseSubstitution(args.path, contract.rolePath, 'IAM role path');
+        args.permissionsBoundary = contract.boundaryArn;
+        args.path = contract.rolePath;
+    });
+    input.registerTransform(input.instanceProfileResource, (value) => {
+        const args = requireTransformArgs(value, 'IAM instance profile');
+        refuseSubstitution(args.path, contract.instanceProfilePath, 'IAM instance-profile path');
+        args.path = contract.instanceProfilePath;
+    });
+    return contract;
+}
+//# sourceMappingURL=stage-authority.js.map