From d511861296df50ee3637f90f3f5f4ef5e0ff6f19 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 29 Sep 2026 19:22:34 -0400
Subject: [PATCH] fix(terraform): let the plan role read bucket website config

The S3 provider refreshes GetBucketWebsite. The plan role was denied on the three Forgejo buckets.
---
 terraform/hcp_iam.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 19b15b1..ceb87b6 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -602,6 +602,7 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
       "s3:GetBucketRequestPayment",
       "s3:GetBucketTagging",
       "s3:GetBucketVersioning",
+      "s3:GetBucketWebsite",
       "s3:GetEncryptionConfiguration",
       "s3:GetLifecycleConfiguration",
       "s3:GetReplicationConfiguration",