[jmgasper]

The Challenge API dev deployment successfully authenticated, passed service/task preflight and pushed its image, then received AccessDenied from ECR DescribeImageScanFindings. Enhanced scanning requires Inspector findings/coverage reads in addition to ECR permissions; both the generated role policy and STS session policy omitted them.

Add only inspector2:ListFindings and inspector2:ListCoverage. The generated role policy restricts these reads to the manifest region. AWS does not support repository-level resource restrictions for these Inspector list actions, so they allow account-wide scan metadata reads in that region. No Inspector write actions are added. Existing roles and boundaries must be updated in the private infrastructure repository; Parameter Store, Secrets Manager, KMS decrypt and role-chaining denies remain intact. Session policy assembly deduplicates adapter actions and stays below the STS size limit.

Validation:

• All 76 tests pass in the pinned CircleCI executor with networking disabled.
• IAM Access Analyzer validation passes; policy simulation permits the two regional reads, rejects them in other regions, rejects Inspector configuration changes, and retains explicit secret/parameter denies.
• CloudTrail confirms the failed ECR scan-read call after successful image publication; administrator inspection found a fresh clean scan. The deployment did not update ECS.
• Shell syntax and diff checks pass.

After merging, publish v2.0.4 and update the Challenge API tag/commit pin for the dev retry. Full scan access under the updated OIDC session remains a live acceptance check.

AWS guidance: https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced-iam.html
Inspector action/resource support: https://docs.aws.amazon.com/service-authorization/latest/reference/list_inspector2.html