From 21e939e8e1085de02b9de4829e8e3ff22a580539 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 6 Aug 2026 17:20:37 -0400
Subject: [PATCH] fix(infra): bind SES bucket policies to receipt rule ARNs

---
 terraform/po_s3.tf | 1 +
 terraform/wo_s3.tf | 1 +
 2 files changed, 2 insertions(+)

diff --git a/terraform/po_s3.tf b/terraform/po_s3.tf
index cfd6b61..f8564ca 100644
--- a/terraform/po_s3.tf
+++ b/terraform/po_s3.tf
@@ -43,6 +43,7 @@ resource "aws_s3_bucket_policy" "po_emails" {
         Condition = {
           StringEquals = {
             "aws:SourceAccount" = local.account_id
+            "aws:SourceArn"     = aws_ses_receipt_rule.po_email.arn
           }
         }
       }
diff --git a/terraform/wo_s3.tf b/terraform/wo_s3.tf
index fe2333a..fb8fc3d 100644
--- a/terraform/wo_s3.tf
+++ b/terraform/wo_s3.tf
@@ -43,6 +43,7 @@ resource "aws_s3_bucket_policy" "wo_emails" {
         Condition = {
           StringEquals = {
             "aws:SourceAccount" = local.account_id
+            "aws:SourceArn"     = aws_ses_receipt_rule.wo_email.arn
           }
         }
       }