From 9107052c9e9bd752f5e9e335258620c15c29799e Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 14 Jul 2026 19:46:39 -0400
Subject: [PATCH] chore(infra): region-bound deploy-role DescribeStacks to
 us-east-1 (sh-security-review IAM-L2)

---
 infra/deploy-role/permissions-policy.json | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/infra/deploy-role/permissions-policy.json b/infra/deploy-role/permissions-policy.json
index 44364e5..4bf29eb 100644
--- a/infra/deploy-role/permissions-policy.json
+++ b/infra/deploy-role/permissions-policy.json
@@ -16,7 +16,12 @@
             "Sid": "CdkDeployHealthCheck",
             "Effect": "Allow",
             "Action": "cloudformation:DescribeStacks",
-            "Resource": "*"
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "aws:RequestedRegion": "us-east-1"
+                }
+            }
         },
         {
             "Sid": "FrontendSiteBucketSync",