IAM user uses temporary credentials outside IAM and STS

# Attach an inline policy to block long-term creds from non-IAM/STS services
resource "aws_iam_user_policy" "deny_non_iam_sts_longterm" {
  name = "DenyNonIamStsWithLongTermCreds"
  user = "<example_resource_name>"  # Critical: target the affected IAM user

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Deny"
      NotAction = ["iam:*", "sts:*"]
      Resource  = "*"
      Condition = {
        Null = { "aws:TokenIssueTime" = "true" } # Critical: denies when no session token (long-lived creds)
      }
    }]
  })
}

# Attach a policy to block long-term creds from accessing non-IAM/STS services
Resources:
  DenyLongTermNonIamSts:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: DenyNonIamStsWithLongTermCreds
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Deny
            NotAction:
              - iam:*
              - sts:*
            Resource: "*"
            Condition:
              Null:
                aws:TokenIssueTime: "true"  # Critical: denies when no session token (i.e., long-lived creds)
      Users:
        - <example_resource_name>  # Critical: attach to the affected IAM user