What

The infrastructure/aws/iam/agent module used to prepend a conventionally-named permissions role ARN (nullplatform-{cluster}-agent-permissions-role) into the agent's sts:AssumeRole policy on every apply, without the caller asking for it. This PR removes that implicit behavior so the agent only assumes the roles explicitly provided.

Why

• Single responsibility: the agent module stopped "knowing" about the k8s permissions role (owned by the k8s scope module).
• No hidden ARN / no duplicates: every assumable role is now visible in one place (assume_role_arns + permissions_roles).
• No dangling grants: clusters without containers no longer get an AssumeRole pointing at a nonexistent role.

Changes

• main.tf: drop [local.permissions_role_arn] from the policy Resource; remove the dead permissions_role_arn local; add a lifecycle.precondition requiring at least one assumable role (avoids an empty Resource, which AWS rejects — now fails fast at plan).
• variables.tf: remove unused permissions_role_name.
• outputs.tf: remove nullplatform_agent_permissions_role_arn.
• tests/agent.tftest.hcl: assert the convention ARN is no longer injected, and that plan fails when no role is provided (expect_failures).
• README.md: docs updated.

Verification

• tofu fmt -check -recursive → clean
• tofu validate → Success
• tofu test → 4 passed, 0 failed
• No internal consumers of the removed output/variable in this repo.

⚠️ Breaking change for callers

Every cluster with containers that relied on the implicit permissions role must now pass it explicitly:

assume_role_arns = [
  module.k8s_agent_permissions.permissions_role_arn, # k8s permissions role — now explicit
  # ...any other roles (e.g. lambda)
]

Without it, the next plan fails the new precondition (explicit failure, not silent). Those caller changes live in the consuming repo.

Note: the AI_METADATA hash in the README is regenerated by the publish tooling; content was updated by hand.

🤖 Generated with Claude Code