From d033be67863e72bed70fae9b403967b6e50734d7 Mon Sep 17 00:00:00 2001
From: Federico Maleh <fedemaleh@yahoo.com.ar>
Date: Thu, 2 Jul 2026 15:20:50 -0300
Subject: [PATCH] fix: write IAM inline policy temp file to OUTPUT_DIR to avoid
 concurrent collision

---
 CHANGELOG.md                         |  1 +
 k8s/scope/iam/create_role            |  2 +-
 k8s/scope/tests/iam/create_role.bats | 52 ++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ecb936b5..3e5b771a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 - Add support to get AWS credentials via assume role
 - Add support to auto-create ALBs on scope create
+- Fix race condition on IAM role creation when multiple scopes are created concurrently
 
 ## [1.12.0] - 2026-06-08
 - Fix: do not inject file parameter as env vars
diff --git a/k8s/scope/iam/create_role b/k8s/scope/iam/create_role
index cfe3342f..2307c703 100644
--- a/k8s/scope/iam/create_role
+++ b/k8s/scope/iam/create_role
@@ -161,7 +161,7 @@ for ((i=0; i<$POLICIES_COUNT; i++)); do
     POLICY_NAME="inline-policy-$((i+1))"
     log debug "📝 Attaching inline policy: $POLICY_NAME"
 
-    TEMP_POLICY_FILE="/tmp/inline-policy-$i.json"
+    TEMP_POLICY_FILE="$OUTPUT_DIR/inline-policy-$i.json"
     echo "$POLICY_VALUE" > "$TEMP_POLICY_FILE"
 
     aws iam put-role-policy \
diff --git a/k8s/scope/tests/iam/create_role.bats b/k8s/scope/tests/iam/create_role.bats
index ef624dbe..bbfd9051 100644
--- a/k8s/scope/tests/iam/create_role.bats
+++ b/k8s/scope/tests/iam/create_role.bats
@@ -263,6 +263,58 @@ teardown() {
   assert_contains "$output" "✅ Successfully attached inline policy: inline-policy-1"
 }
 
+# =============================================================================
+# Test: Inline policy document is written under OUTPUT_DIR, not /tmp
+# (regression: shared /tmp path collided across concurrent create_role runs)
+# =============================================================================
+@test "create_role: inline policy document is written under OUTPUT_DIR" {
+  export IAM='{
+    "ENABLED": "true",
+    "PREFIX": "test-prefix",
+    "ROLE": {
+      "BOUNDARY_ARN": null,
+      "POLICIES": [
+        {"TYPE": "inline", "VALUE": "{\"Version\":\"2012-10-17\",\"Statement\":[]}"}
+      ]
+    }
+  }'
+
+  aws() {
+    case "$*" in
+      *"eks describe-cluster"*)
+        echo "https://oidc.eks.us-east-1.amazonaws.com/id/ABCDEF1234567890"
+        ;;
+      *"sts get-caller-identity"*)
+        echo "123456789012"
+        ;;
+      *"iam create-role"*)
+        echo '{"Role": {"Arn": "arn:aws:iam::123456789012:role/test-prefix-test-scope-123"}}'
+        ;;
+      *"iam put-role-policy"*)
+        # Emit the args so the test can assert on the --policy-document path
+        echo "PUT_ROLE_POLICY_ARGS: $*"
+        ;;
+      *)
+        return 0
+        ;;
+    esac
+  }
+  export -f aws
+
+  run bash -c 'source "$SCRIPT"'
+
+  assert_equal "$status" "0"
+  assert_contains "$output" "--policy-document file://$OUTPUT_DIR/inline-policy-0.json"
+
+  # Guard against the shared /tmp path regression
+  if echo "$output" | grep -q "file:///tmp/inline-policy"; then
+    uses_tmp="true"
+  else
+    uses_tmp="false"
+  fi
+  assert_false "$uses_tmp" "inline policy document under /tmp"
+}
+
 # =============================================================================
 # Test: Unknown policy type shows warning
 # =============================================================================