Include profile::boot_security_upgrade in role::jumphost

[akuzminsky]

First non-runner consumer of the profile added in #294 / #295.

  include 'profile::base'
  include 'profile::jumphost'

+ # Patch during provisioning so Inspector's first scan sees an already-patched
+ # host. Takes the default fail_on_error => false: unlike a runner, a jumphost
+ # is long-lived and not disposable, so an unpatched-but-reachable bastion beats
+ # an ABANDONed one.
+ include 'profile::boot_security_upgrade'

One file covers every environment. role/ exists only in global modules/ — environments carry just profile/ — so there is no per-environment role copy to promote. It resolves in all three because #295 put the profile in all three trees.

Verification

Compiled a full role::jumphost catalog (external modules stubbed, provision-time facts supplied) against all three modulepaths — modules alone, and each environment overlay. Identical in each:

returns : [0,1]   timeout: 540
creates : /run/boot-security-upgrade.done
command : /usr/local/bin/boot-security-upgrade.sh --budget 480 \
          --marker /run/boot-security-upgrade.done --exclusion-tag InspectorEc2Exclusion
Package[cloud-guest-utils] count: 1
Package[awscli] count:            1

returns [0,1] confirms the log-and-continue default is what a jumphost gets. Both packages appearing exactly once was the real thing to check here — profile::boot_security_upgrade declares cloud-guest-utils and includes profile::packages, while the role already pulls profile::base, so a duplicate declaration was the plausible failure mode. There isn't one.

Expected behavior on hosts without the tag

This is deliberately being rolled out to existing jumphosts that carry no InspectorEc2Exclusion tag, to confirm a missing tag is harmless. Two possible log lines, both exit 0, neither fails the run:

• removed InspectorEc2Exclusion from i-... — delete-tags ignores a key that is not present, so this is what a successful API call prints whether or not the tag existed
• could not remove ... (no ec2:DeleteTags?) — the instance profile lacks the permission

Worth noting the first message is ambiguous by design of the AWS API: it proves the call succeeded, not that a tag was removed. Making the removal test conclusive would need a describe-tags first, and therefore ec2:DescribeTags on the instance profile — not done here.

Next step after this: terraform-aws-jumphost sets the tag at launch, which is what actually closes the Inspector window.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KLGAXtoyoakLXUjaJSL4M3