diff --git a/terraform/iam.tf b/terraform/iam.tf
index a2b4024..f25c0ea 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -41,8 +41,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "dynamodb:UpdateItem",
     ]
     resources = [
-      aws_dynamodb_table.shifts.arn,
-      "${aws_dynamodb_table.shifts.arn}/index/*",
+      "arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}",
+      "arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}/index/*",
     ]
   }
 
@@ -93,7 +93,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "sqs:DeleteMessage",
       "sqs:GetQueueAttributes",
     ]
-    resources = [aws_sqs_queue.jobs.arn]
+    resources = ["arn:aws:sqs:${var.aws_region}:${local.account_id}:${local.project}-jobs"]
   }
 
   dynamic "statement" {
@@ -121,7 +121,7 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "ecr:BatchGetImage",
       "ecr:GetDownloadUrlForLayer",
     ]
-    resources = [aws_ecr_repository.api.arn]
+    resources = ["arn:aws:ecr:${var.aws_region}:${local.account_id}:repository/${local.project}"]
   }
 
   statement {
@@ -133,8 +133,8 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
       "logs:CreateLogGroup",
     ]
     resources = [
-      aws_cloudwatch_log_group.api.arn,
-      "${aws_cloudwatch_log_group.api.arn}:*",
+      "arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}",
+      "arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}:*",
     ]
   }
 }
diff --git a/tests/infra/test_hcp_contract.py b/tests/infra/test_hcp_contract.py
index 152ef5b..e00f5f6 100644
--- a/tests/infra/test_hcp_contract.py
+++ b/tests/infra/test_hcp_contract.py
@@ -85,6 +85,18 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
     assert "hcptf_apply_ecs" in HCP_IAM
 
 
+def test_ecs_task_boundary_uses_static_arns():
+    iam = (TERRAFORM / "iam.tf").read_text()
+    chunk = iam.split('data "aws_iam_policy_document" "ecs_task_boundary"')[1]
+    chunk = chunk.split("resource ")[0]
+    assert "aws_dynamodb_table.shifts" not in chunk
+    assert "aws_sqs_queue.jobs" not in chunk
+    assert "aws_ecr_repository.api" not in chunk
+    assert "aws_cloudwatch_log_group.api" not in chunk
+    assert "table/${local.table_name}" in chunk
+    assert "log-group:/ecs/${local.project}" in chunk
+
+
 def test_deploy_api_workflow_exists():
     deploy_api = (ROOT / ".github" / "workflows" / "deploy-api.yaml").read_text()
     assert "environment: ${{ needs.target.outputs.environment }}" in deploy_api