Fix Bedrock IAM for cross-region inference profiles (#47)

## Summary

Cross-region inference profiles (`eu.anthropic.*`) route to foundation
models in EU destination regions (eu-central-1, eu-north-1, eu-west-1,
eu-west-3). IAM requires explicit access to the destination foundation
model ARNs, not just the inference profile.

This was hidden by the old `*:*` infra role and has been a latent bug on
the Lambda roles (slack-alert, cost-report) — they'd fail if Bedrock
routed to eu-north-1.

Adds a second IAM statement with foundation model ARNs for all EU
destination regions, scoped via `bedrock:InferenceProfileArn` condition
so they only work through our inference profiles.

Fixes: ci-infra-plan role, slack-alert Lambda role, cost-report Lambda
role.

## Test plan

- [ ] Plan job succeeds with LLM review (Bedrock call works)
- [ ] Apply creates the IAM policy changes on Lambda roles

Author: Alexanderamiri

scripts/extract-review-risk.sh

@@ -21,3 +21,8 @@ fi
 
 echo "risk_level=${RISK}" >> "$GITHUB_OUTPUT"
 echo "LLM review risk: ${RISK}"
+
+if [ "$RISK" = "FAILED" ]; then
+  echo "LLM review failed — blocking pipeline."
+  exit 1
+fi

terraform/platform/iam/main.tf

@@ -94,14 +94,31 @@ resource "aws_iam_role_policy" "ci_infra_plan_extras" {
         Resource = "arn:aws:s3:::${var.project}-ci-plan-artifacts-${var.aws_account_id}/*"
       },
       {
-        Sid    = "BedrockForReview"
+        Sid    = "BedrockInferenceProfile"
         Effect = "Allow"
         Action = [
           "bedrock:InvokeModel",
           "bedrock:Converse",
         ]
         Resource = "arn:aws:bedrock:${var.region}:${var.aws_account_id}:inference-profile/eu.anthropic.*"
       },
+      {
+        # Cross-region inference profiles route to foundation models in EU
+        # destination regions. IAM requires access to destination model ARNs.
+        # Condition scopes this to only work via our inference profiles.
+        Sid    = "BedrockFoundationModels"
+        Effect = "Allow"
+        Action = [
+          "bedrock:InvokeModel",
+          "bedrock:Converse",
+        ]
+        Resource = "arn:aws:bedrock:eu-*::foundation-model/anthropic.*"
+        Condition = {
+          StringLike = {
+            "bedrock:InferenceProfileArn" = "arn:aws:bedrock:${var.region}:${var.aws_account_id}:inference-profile/eu.anthropic.*"
+          }
+        }
+      },
       {
         Sid      = "SSMReadSlackWebhook"
         Effect   = "Allow"

terraform/platform/lambdas/main.tf

@@ -6,6 +6,11 @@
 locals {
   lambda_src_path = "${path.module}/../../lambda-src"
   github_org_url  = "https://github.com/javaBin"
+
+  # EU cross-region inference profiles route to any eu-* region.
+  # IAM requires foundation model access in destination regions.
+  bedrock_eu_foundation_model_arns = "arn:aws:bedrock:eu-*::foundation-model/anthropic.*"
+  bedrock_inference_profile_arn    = "arn:aws:bedrock:${var.region}:${var.aws_account_id}:inference-profile/eu.anthropic.*"
 }
 
 ################################################################################
@@ -159,13 +164,21 @@ resource "aws_iam_role_policy" "slack_alert" {
         ]
       },
       {
-        Sid    = "Bedrock"
-        Effect = "Allow"
-        Action = [
-          "bedrock:InvokeModel",
-          "bedrock:Converse",
-        ]
-        Resource = "arn:aws:bedrock:${var.region}:${var.aws_account_id}:inference-profile/eu.anthropic.*"
+        Sid      = "BedrockInferenceProfile"
+        Effect   = "Allow"
+        Action   = ["bedrock:InvokeModel", "bedrock:Converse"]
+        Resource = local.bedrock_inference_profile_arn
+      },
+      {
+        Sid      = "BedrockFoundationModels"
+        Effect   = "Allow"
+        Action   = ["bedrock:InvokeModel", "bedrock:Converse"]
+        Resource = local.bedrock_eu_foundation_model_arns
+        Condition = {
+          StringLike = {
+            "bedrock:InferenceProfileArn" = local.bedrock_inference_profile_arn
+          }
+        }
       },
       {
         Sid    = "PricingRead"
@@ -236,13 +249,21 @@ resource "aws_iam_role_policy" "cost_report" {
         Resource = "*"
       },
       {
-        Sid    = "Bedrock"
-        Effect = "Allow"
-        Action = [
-          "bedrock:InvokeModel",
-          "bedrock:Converse",
-        ]
-        Resource = "arn:aws:bedrock:${var.region}:${var.aws_account_id}:inference-profile/eu.anthropic.*"
+        Sid      = "BedrockInferenceProfile"
+        Effect   = "Allow"
+        Action   = ["bedrock:InvokeModel", "bedrock:Converse"]
+        Resource = local.bedrock_inference_profile_arn
+      },
+      {
+        Sid      = "BedrockFoundationModels"
+        Effect   = "Allow"
+        Action   = ["bedrock:InvokeModel", "bedrock:Converse"]
+        Resource = local.bedrock_eu_foundation_model_arns
+        Condition = {
+          StringLike = {
+            "bedrock:InferenceProfileArn" = local.bedrock_inference_profile_arn
+          }
+        }
       },
     ]
   })