From 66e5321a42f9d6d8f896d83fd68d9b4627ff578d Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 16 Sep 2026 14:12:34 -0400
Subject: [PATCH] fix(infra): add EIP describe and DynamoDB CMK grants for
 first apply

Scoped apply missed ec2:DescribeAddressesAttribute and kms Encrypt/Decrypt/GenerateDataKey on the table CMK.
---
 terraform/hcp_iam.tf | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index f0340e8..89e1a92 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -471,6 +471,10 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "kms:CreateGrant",
       "kms:ListGrants",
       "kms:RetireGrant",
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+      "kms:GenerateDataKeyWithoutPlaintext",
     ]
     resources = [local.dynamodb_cmk_arn]
   }
@@ -553,6 +557,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "ec2:DeleteVpcEndpoints",
       "ec2:DescribeAccountAttributes",
       "ec2:DescribeAddresses",
+      "ec2:DescribeAddressesAttribute",
       "ec2:DescribeAvailabilityZones",
       "ec2:DescribeInternetGateways",
       "ec2:DescribeNatGateways",
@@ -819,6 +824,8 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
       "kms:DescribeKey",
       "kms:GetKeyPolicy",
       "kms:ListResourceTags",
+      "kms:CreateGrant",
+      "kms:ListGrants",
     ]
     resources = [local.dynamodb_cmk_arn]
   }
@@ -827,7 +834,9 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
     sid    = "RefreshEc2"
     effect = "Allow"
     actions = [
+      "ec2:DescribeAccountAttributes",
       "ec2:DescribeAddresses",
+      "ec2:DescribeAddressesAttribute",
       "ec2:DescribeAvailabilityZones",
       "ec2:DescribeInternetGateways",
       "ec2:DescribeNatGateways",