Custom IAM policy blocks marketplace:Subscribe on all

resource "aws_iam_policy" "scoped_marketplace_subscribe" {
  name = "scoped-marketplace-subscribe"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["aws-marketplace:Subscribe"]
      Resource = ["arn:aws:aws-marketplace::123456789012:product/approved-product-id"]  # FIX: scope to specific products
    }]
  })
}

Resources:
  ScopedMarketplacePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - aws-marketplace:Subscribe  # FIX: scope to specific product ARNs
            Resource:
              - arn:aws:aws-marketplace::123456789012:product/approved-product-id