Offline-proven Terraform for the cross-account consumer deploy-role + nova:owner ABAC tag grant. This is the "role grant" half of the no-humans onboarding flow (D-113); the "request" half is P18 (Lambda action) + P19 (env-file autogen).

Scope (D-114)

This Terraform is offline-proven only in v1.16:

terraform validate passes.
terraform plan (with NOVA_AWS_ACCOUNT_ID set) produces the expected role + policy.
No live apply — NOVA_LIFECYCLE_MODE=plan default. Live apply is deferred to a future feature milestone (D-113/D-114).

Variables

Variable	Description	Default
`consumer_repo`	The consumer repository (org/repo)	`acdl/consumer-a`
`owner_id`	The owning team (for `nova:owner` tag)	`team-a`
`account_id`	The consumer's AWS account ID	`000000000000`
`region`	AWS region	`us-east-1`

Resources

aws_iam_role.consumer_deploy — the consumer's deploy role with a trust policy (assumed by the consumer's CI runner).
aws_iam_role_policy.consumer_invoke — inline policy granting lambda:InvokeFunctionUrl on the platform Lambda, scoped via aws:PrincipalTag/nova:owner == var.owner_id (ABAC).
aws_iam_tag.owner — tags the role with nova:owner + nova:contract.

Usage (offline)

cd terraform/onboarding
terraform init -backend=false
terraform validate
NOVA_AWS_ACCOUNT_ID=123456789012 terraform plan -var consumer_repo=acdl/my-app -var owner_id=team-x