Terraform plan looks safe but apply recreates IAM roles after a for_each key rename

No obvious destructive change is noticed in review, yet apply replaces active roles because the stable key used by for_each changed during a refactor.