From 8360cfb1db592af17eb39309ef8418a18be84bd9 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 29 Sep 2026 19:10:08 -0400
Subject: [PATCH] fix(terraform): allow HCP refresh of the log group and
 parameter

The scoped apply role can create those resources, but CloudWatch and SSM list them on a wildcard ARN. DescribeLogGroups and DescribeParameters need that resource.
---
 terraform/hcp_iam.tf | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index a64145a..19b15b1 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -437,6 +437,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
   }
 
   # CreateLogGroup is not reliable on the log-group ARN before the group exists.
+  # DescribeLogGroups is a list API. Its resource is log-group::log-stream:, not the group ARN.
   statement {
     sid       = "CreateVerificationLogGroup"
     effect    = "Allow"
@@ -444,6 +445,13 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
     resources = ["*"]
   }
 
+  statement {
+    sid       = "DescribeVerificationLogGroups"
+    effect    = "Allow"
+    actions   = ["logs:DescribeLogGroups"]
+    resources = ["*"]
+  }
+
   statement {
     sid    = "VerificationLogs"
     effect = "Allow"
@@ -501,6 +509,14 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
     ]
   }
 
+  # DescribeParameters does not accept a parameter ARN. The provider calls it on *.
+  statement {
+    sid       = "DescribeBackupParameters"
+    effect    = "Allow"
+    actions   = ["ssm:DescribeParameters"]
+    resources = ["*"]
+  }
+
   statement {
     sid    = "AlertTopicRead"
     effect = "Allow"
@@ -687,7 +703,6 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
     sid    = "RefreshLogs"
     effect = "Allow"
     actions = [
-      "logs:DescribeLogGroups",
       "logs:ListTagsForResource",
     ]
     resources = [
@@ -696,6 +711,14 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
     ]
   }
 
+  # DescribeLogGroups is a list API. Its resource is log-group::log-stream:, not the group ARN.
+  statement {
+    sid       = "DescribeVerificationLogGroups"
+    effect    = "Allow"
+    actions   = ["logs:DescribeLogGroups"]
+    resources = ["*"]
+  }
+
   statement {
     sid    = "RefreshAlarms"
     effect = "Allow"
@@ -718,6 +741,13 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
     ]
   }
 
+  statement {
+    sid       = "DescribeBackupParameters"
+    effect    = "Allow"
+    actions   = ["ssm:DescribeParameters"]
+    resources = ["*"]
+  }
+
   statement {
     sid    = "RefreshSnapshots"
     effect = "Allow"