tofu/iam.github_oidc.tofu:122

• The IAM policy grants bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on Resource: "*", which allows the role to invoke any foundation model (including expensive ones) in any region. Since this role is intended specifically for "PR review using Bedrock claude", consider scoping the InvokeModel* actions to the specific Claude foundation-model and/or inference-profile ARNs (e.g. arn:aws:bedrock:<region>::foundation-model/anthropic.claude-* and the relevant inference-profile/* ARN). The List*/Get* actions can remain on * since they do not support resource-level permissions. This better follows the "scoped-down policy" principle referenced in the description comment at the top of this file.

      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModel",
        "bedrock:ListInferenceProfiles",
        "bedrock:GetInferenceProfile"
      ],
      "Resource": "*"

tofu/iam.github_oidc.tofu:105

• The description reads "IAM policy for GitHub OIDC role to access ${terraform.workspace}-bedrock-claude policy", but this policy grants access to Bedrock Claude models, not to another policy resource. Consider rewording, e.g. "IAM policy for GitHub OIDC role to invoke Bedrock Claude models", to avoid confusion when this description is surfaced in the AWS console.

  description = "IAM policy for GitHub OIDC role to access ${terraform.workspace}-bedrock-claude policy"

tofu/iam.github_oidc.tofu:103

• Minor naming inconsistency: the module is named iam_github_portfolio_bedrock_claude_policy and the resource name includes github-portfolio-bedrock-claude-policy, but this Bedrock policy is unrelated to the portfolio website (per the section comment "PR review using Bedrock claude"). The sibling resource above is iam_github_portfolio_website_s3_policy, where "portfolio" makes sense. Consider dropping portfolio from the module/policy name (e.g. iam_github_bedrock_claude_policy / ${workspace}-github-bedrock-claude-policy) to match the role name on line 133 (${workspace}-github-bedrock-claude-role) and the section heading.

module "iam_github_portfolio_bedrock_claude_policy" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-policy"
  version = local.vars.iam.version

  name        = "${terraform.workspace}-github-portfolio-bedrock-claude-policy"