fix(aws): complete drift detection access (#191)

## Summary
- add the stack-scoped `cloudformation:DetectStackResourceDrift`
permission required by full-stack drift detection
- add region-scoped `cloudformation:BatchDescribeTypeConfigurations`,
also required by AWS for drift detection
- preserve the operator/data-plane separation

## Evidence
- `npm run check`
- `npm test` (630 passed, 6 skipped)
- `npm run build`
- `sam validate --lint --template-file template.yaml`
- live CloudFormation template validation
- focused Access Analyzer validation: zero errors/security warnings

## Live failure reproduced
After the least-privilege stack reached `CREATE_COMPLETE` with
termination protection and the retained-resource stack policy enabled,
`status aws --detect-drift` failed specifically on
`cloudformation:DetectStackResourceDrift`. AWS documents that action and
`BatchDescribeTypeConfigurations` as required companions to
`DetectStackDrift`.

Part of #174.

Author: yhay81

deploy/aws-cloudformation-bootstrap.yaml

@@ -429,6 +429,13 @@ Resources:
             Condition:
               StringEquals:
                 aws:RequestedRegion: !Ref AWS::Region
+          - Sid: ReadRegionalDriftTypeConfigurations
+            Effect: Allow
+            Action: cloudformation:BatchDescribeTypeConfigurations
+            Resource: "*"
+            Condition:
+              StringEquals:
+                aws:RequestedRegion: !Ref AWS::Region
           - Sid: ReadAndPlanExactHayaSendStacks
             Effect: Allow
             Action:
@@ -439,6 +446,7 @@ Resources:
               - cloudformation:DescribeStackResources
               - cloudformation:DescribeStacks
               - cloudformation:DetectStackDrift
+              - cloudformation:DetectStackResourceDrift
               - cloudformation:GetStackPolicy
               - cloudformation:GetTemplate
               - cloudformation:GetTemplateSummary

tests/aws-cloudformation-bootstrap-template.test.ts

@@ -83,6 +83,12 @@ describe("AWS CloudFormation deployment bootstrap template", () => {
     expect(operatorSection).toContain("sts:GetCallerIdentity");
     expect(operatorSection).toContain("ses:GetAccount");
     expect(operatorSection).toContain("cloudwatch:DescribeAlarms");
+    expect(operatorSection).toContain(
+      "cloudformation:BatchDescribeTypeConfigurations",
+    );
+    expect(operatorSection).toContain(
+      "cloudformation:DetectStackResourceDrift",
+    );
     expect(operatorSection).toContain("aws:RequestedRegion: !Ref AWS::Region");
     expect(operatorSection).not.toContain("changeSet/*/*");
     expect(operatorSection).not.toMatch(