Impact: repository revisions before v1.3.2 included a deployment SCP template that could allow tag-on-create bypasses for hulumi:iac-role protections, weakening the intended IAM boundary in downstream deployments.
Patched in v1.3.2: the SCP template and guide were tightened and covered by regression checks.
Remediation: update deployment templates and guidance from repository tag v1.3.2 or later.
Impact: repository revisions before v1.3.2 included a deployment SCP template that could allow tag-on-create bypasses for hulumi:iac-role protections, weakening the intended IAM boundary in downstream deployments.
Patched in v1.3.2: the SCP template and guide were tightened and covered by regression checks.
Remediation: update deployment templates and guidance from repository tag v1.3.2 or later.