From 5a34e8aef1c3fa1c435de50d1859c1e262ef379c Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:30:19 -0300
Subject: [PATCH 1/2] fix(assume-role): resolve the IAM provider by category
 instead of specification slug

np provider list ignores --specification_slug and returns every provider
under the nrn, so the lookup took whichever provider came first and the
role never resolved. Filter by the identity-access-control category, which
the API honors.
---
 lambda/scope/tests/scripts/assume_role_lib.bats | 4 ++--
 lambda/utils/assume_role_lib                    | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/lambda/scope/tests/scripts/assume_role_lib.bats b/lambda/scope/tests/scripts/assume_role_lib.bats
index 2428799..e8129f5 100644
--- a/lambda/scope/tests/scripts/assume_role_lib.bats
+++ b/lambda/scope/tests/scripts/assume_role_lib.bats
@@ -129,7 +129,7 @@ JSON='{"attributes":{"iam_role_arns":{"arns":[{"selector":"s3","arn":"arn:aws:ia
 @test "resolve_assume_role_arn: IAM provider when no env override" {
   np() {
     case "$*" in
-      *"--specification_slug aws-iam-configuration"*) echo '{"results":[{"id":"iam-1"}]}' ;;
+      *"--categories identity-access-control"*) echo '{"results":[{"id":"iam-1"}]}' ;;
       *"provider read"*) echo '{"attributes":{"iam_role_arns":{"arns":[{"selector":"lambda","arn":"arn:provider:lambda"}]}}}' ;;
       *) echo '{}' ;;
     esac
@@ -143,7 +143,7 @@ JSON='{"attributes":{"iam_role_arns":{"arns":[{"selector":"s3","arn":"arn:aws:ia
 @test "resolve_assume_role_arn: scope-config fallback when provider misses" {
   np() {
     case "$*" in
-      *"--specification_slug aws-iam-configuration"*) echo '{"results":[]}' ;;
+      *"--categories identity-access-control"*) echo '{"results":[]}' ;;
       *"--categories scope-configurations"*) echo '{"results":[{"attributes":{"assume_role":{"arn":"arn:scopecfg:legacy"}}}]}' ;;
       *) echo '{}' ;;
     esac
diff --git a/lambda/utils/assume_role_lib b/lambda/utils/assume_role_lib
index 7f2b503..b216011 100644
--- a/lambda/utils/assume_role_lib
+++ b/lambda/utils/assume_role_lib
@@ -32,9 +32,11 @@ provider_arn_for_selector() {
   [ -n "$selector" ] || return 0
 
   local pid data
+  # Filter by category: the API ignores --specification_slug and returns every
+  # provider under the nrn, so "first" would pick an unrelated one.
   pid=$(np provider list --nrn "$nrn" \
-          --specification_slug aws-iam-configuration \
-          --format json --limit 100 2>/dev/null \
+          --categories identity-access-control \
+          --format json 2>/dev/null \
         | jq -r '[ (.results // [])[] ] | first | .id // ""' 2>/dev/null)
   [ -n "$pid" ] && [ "$pid" != "null" ] || return 0
 

From 25768e78d508d60a0cfa941b9e587f79c92897d8 Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:41:47 -0300
Subject: [PATCH 2/2] fix(requirements): allow iam:ListInstanceProfilesForRole
 so delete-scope can remove the role

The AWS provider lists a role's instance profiles before deleting it; without
this action every tofu destroy fails on aws_iam_role.lambda and the scope is
left in failed with the role behind.
---
 lambda/specs/requirements/main.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lambda/specs/requirements/main.tf b/lambda/specs/requirements/main.tf
index e9971bf..d51e79e 100644
--- a/lambda/specs/requirements/main.tf
+++ b/lambda/specs/requirements/main.tf
@@ -100,6 +100,7 @@ resource "aws_iam_policy" "nullplatform_lambda_iam_policy" {
           "iam:CreateRole",
           "iam:GetRole",
           "iam:DeleteRole",
+          "iam:ListInstanceProfilesForRole",
           "iam:PutRolePolicy",
           "iam:GetRolePolicy",
           "iam:DeleteRolePolicy",