[Benettonkkb]

Fixes #138

What changes did you make?

• Documented a concrete explicit-deny guardrail for the incubator Terraform apply role.
• Compared an attached deny policy with a permissions boundary, a least-privilege replacement, and an account-level SCP.
• Added anti-tamper controls, limitations, implementation steps, validation commands, and AWS references.
• Linked the research from the repository README.

Why did you make the changes (we will use this info to test)?

• The apply workflow assumes incubator-tf-apply with AdministratorAccess, while the current Terraform configuration does not manage IAM users or billing resources.
• Issue Research - Restrict incubator apply privileges #138 asks for exception permissions that can be layered over AdministratorAccess, including IAM-user and billing restrictions.
• The recommendation preserves required workload-role management while making the remaining delegated-role bypass explicit for reviewers.

Validation

• Parsed the proposed policy as valid JSON with five statements.
• Ran git diff --check with no errors.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.