From be1160192c11f099cf84084de8cfeafc3383e549 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 21 Sep 2026 22:56:09 +0000
Subject: [PATCH] fix(infra): allow hcptf apply to create ECS and ELB
 service-linked roles (PLAT-216) (#265)

---
 terraform/hcp_iam.tf             | 12 ++++++++++++
 tests/infra/test_hcp_contract.py |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index e739ccc..fefde85 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -634,6 +634,18 @@ data "aws_iam_policy_document" "hcptf_apply_ecs" {
     resources = ["*"]
   }
 
+  statement {
+    sid    = "CreateElbAndEcsServiceLinkedRoles"
+    effect = "Allow"
+    actions = [
+      "iam:CreateServiceLinkedRole",
+    ]
+    resources = [
+      "arn:aws:iam::${local.account_id}:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing",
+      "arn:aws:iam::${local.account_id}:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS",
+    ]
+  }
+
   statement {
     sid    = "EcrRepo"
     effect = "Allow"
diff --git a/tests/infra/test_hcp_contract.py b/tests/infra/test_hcp_contract.py
index a82e24b..899ecb4 100644
--- a/tests/infra/test_hcp_contract.py
+++ b/tests/infra/test_hcp_contract.py
@@ -79,6 +79,8 @@ def test_stack_owns_a_vpc_instead_of_looking_up_default():
     assert 'resource "aws_iam_policy" "hcptf_apply_ecs"' in HCP_IAM
     assert 'resource "aws_iam_role_policy" "hcptf_apply_ecs"' not in HCP_IAM
     assert "aws_iam_policy.hcptf_apply_ecs.arn" in HCP_IAM
+    assert "sid    = \"CreateElbAndEcsServiceLinkedRoles\"" in HCP_IAM
+    assert "iam:CreateServiceLinkedRole" in HCP_IAM
 
 
 def test_ecs_task_boundary_uses_static_arns():