Bug fixes

• resource/turbot_policy_pack_attachment, resource/turbot_smart_folder_attachment: Fixed Forbidden: Insufficient permissions for identities holding permissions only on the attachment target. Policy packs are now resolved through the same query the Guardrails console uses, so attaching a pack no longer requires a grant on the pack itself. Both numeric IDs and AKAs continue to work. (#244)
• resource/turbot_policy_pack_attachment, resource/turbot_smart_folder_attachment: Fixed attachments being silently dropped when several policy packs are attached to the same resource in a single apply — attaching six packs to one folder reported success for all six and persisted four, with no error. Attachment writes are now serialised per target resource and confirmed after writing, so a lost write fails loudly instead of surfacing as drift on a later plan. (#246)
• resource/turbot_policy_pack_attachment, resource/turbot_smart_folder_attachment: Fixed a detach that could be reported as successful without taking effect, leaving a policy pack attached and still evaluating against the target after Terraform had removed it from state. Detaches are now confirmed the same way attachments are. (#246)
• resource/turbot_policy_pack_attachment, resource/turbot_smart_folder_attachment: Fixed a live attachment being dropped from state and recreated when an unrelated error mentioned not found. Whether an attachment target still exists is now determined from the API response rather than from error text. (#246)

Security

• Policy pack read queries now pass their identifier as a GraphQL variable instead of interpolating it into the query document. Interpolation allowed an identifier supplied in Terraform configuration to close the string literal and append arbitrary GraphQL, which was then executed with the provider's credentials — a concern wherever configuration comes from a less trusted source than the credentials, such as a pull request in an automated pipeline. (#244)