#pr-reviews - November 2026

Hi team, I have a proposition to patch policy for security hub -
github.com/cloudposse-terraform-components/aws-security-hub/pull/61

Without a condition, the delegated administrator can call DisablePolicyType for any policy type, including SERVICE_CONTROL_POLICY

Hi team 👋 Could someone take a look at these, please?

1. Node 24 runtime for install-gh-releases
github.com/cloudposse-github-actions/install-gh-releases/pull/35
• Changes the action runtime from node20 to node24, updates .node-version and engines, and pins the CI actions to Node 24 releases. The action code is unchanged.
• github-action-atmos-terraform-apply uses this action, so every apply run logs the "Node.js 20 is deprecated … forced to run on Node.js 24" warning.

2. aws-argocd-github-repo: deploy keys hardcoded to RSA-2048, which GitHub now rejects
github.com/cloudposse-terraform-components/aws-argocd-github-repo/issues/64
• tls_private_key uses rsa_bits = "2048", so adding a new environment fails with 422 key is too short … at least 3072 bits. Affects v2.1.1 and v2.2.0 (latest).
• Suggested fix: change it to rsa_bits = 4096 (or ED25519), or make it a variable. Happy to raise the PR if that's the preferred approach.

Thanks! 🙏