[tim-thacker-nullify]

The connector role cannot run the IAM permission diagnostic that Nullify uses to assess its collector grants.

• Allow iam:SimulatePrincipalPolicy only on the connector's exact role ARN in CloudFormation and both Terraform provider variants.
• Preserve the existing collector and Session Manager document grants.
• Cover account, customer-role and partition boundaries; document existing-stack update order.
• Resolve leading literal Terraform role locals in the policy-drift checker; reject unsupported definitions and retain wrong-role/account mismatches.

flowchart LR
  ROLE["Customer connector role"] --> CHECK["New: simulate its own policy"]
  CHECK --> SELF["Exact account and connector role"]
  CHECK --> OTHER["Other role or account: denied"]

Loading

Read-only AWS policy simulation allowed the exact role and denied another customer role and another account. Eleven template/checker scope regressions, policy-drift comparisons, cfn-lint and all 31 mocked Terraform plans passed.

• Correctness confidence: 95%; ARN scope and template validation pass; a live stack update remains untested.
• Merge risk: low; one diagnostic permission is added to existing policies without resource replacement.
• Activation risk: moderate; deploy the resource-aware Nullify probe before applying this template through each existing stack or StackSet. An old probe can misreport the restricted SSM grant.
• No template publication, deployment or live IAM changes are included. All merges are held.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}