docs(cloud-security): document the AWS iam_boundaries provider-test check

[maximelb]

What was asked

The AWS provider test gained an optional iam_boundaries check (IAM permission boundary collection, parity package C2). The verify-and-coverage table on the AWS provider-setup page should list it, like every other probe.

What was done

One row in docs/cloud-security/provider-setup/aws.md, stating what is lost if the check fails: a principal whose permissions boundary caps it below its attached policies is scored on the uncapped policies, so it can be reported as an administrator when it is not.

The check is optional and needs no policy change — iam:GetAccountAuthorizationDetails is covered by iam:Get* in SecurityAudit, which the page already tells operators to attach, so a role built the documented way passes. The row exists for operators who attach a hand-rolled least-privilege policy instead; the "With SecurityAudit + ViewOnlyAccess, every optional surface above also passes" line below the table remains true and is unchanged.

Testing

Markdown only.

Note

The org_policies check (parity package C1) is also missing from this table; it belongs to that package's own docs change and is deliberately left alone here to avoid two PRs editing the same rows.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y3AnxeGmcGA9scrsRZFtg9