From 9bffddfd7b9c27774be4c764e7b1ddb9bbba5b75 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 20 Aug 2026 15:22:09 -0400
Subject: [PATCH] fix(iam): allow site plan role to describe CF function
 (PLAT-106)

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index d1d97c6..8af2c84 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1472,6 +1472,14 @@ Resources:
                   - cloudfront:Get*
                   - cloudfront:List*
                 Resource: "*"
+              # aws_cloudfront_function refresh reads DEVELOPMENT via
+              # DescribeFunction. Get* does not cover that API (PLAT-106).
+              - Sid: RefreshCloudFrontFunction
+                Effect: Allow
+                Action:
+                  - cloudfront:DescribeFunction
+                Resource:
+                  - !Sub "arn:aws:cloudfront::${AWS::AccountId}:function/seahaven-site-prod-directory-index"
               - Sid: RefreshAcm
                 Effect: Allow
                 Action: