From 1c87a61cfcff7a552124de95c4f8df599692b741 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 12:51:04 -0400
Subject: [PATCH] fix(iam): grant shoc-backend staging plan named inventory
 reads (PLAT-148)

---
 .../terraform-substrate.template.yaml         | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index ed192be..0862c8b 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3446,6 +3446,7 @@ Resources:
                 Effect: Allow
                 Action:
                   - acm:ListCertificates
+                  - autoscaling:DescribeAutoScalingGroups
                   - ec2:DescribeSecurityGroups
                   - ec2:DescribeSubnets
                   - ec2:DescribeVpcs
@@ -3456,12 +3457,26 @@ Resources:
                   - elasticbeanstalk:DescribeEnvironments
                   - elasticbeanstalk:ListTagsForResource
                   - rds:DescribeDBInstances
+                  - route53:ListHostedZones
                   - route53:ListHostedZonesByName
                 Resource: "*"
+              # Elastic Beanstalk DescribeConfigurationSettings calls
+              # CreateBucket against its existing regional service bucket
+              # during both plan and apply refresh.
+              - Sid: AuthorizeExistingEbBucketDiscovery
+                Effect: Allow
+                Action:
+                  - s3:CreateBucket
+                  - s3:PutBucketOwnershipControls
+                Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
+                Condition:
+                  StringEquals:
+                    s3:x-amz-object-ownership: ObjectWriter
               - Sid: ReadSharedCertificate
                 Effect: Allow
                 Action:
                   - acm:DescribeCertificate
+                  - acm:GetCertificate
                   - acm:ListTagsForCertificate
                 Resource: arn:aws:acm:us-east-1:396287094661:certificate/2b78e74f-7b65-4b82-a413-7a498b102f00
               - Sid: ReadSharedRdsTags
@@ -3540,6 +3555,13 @@ Resources:
                 Condition:
                   StringEquals:
                     "iam:PermissionsBoundary": arn:aws:iam::396287094661:policy/shoc-backend-staging-runtime-boundary
+              - Sid: UpdateStagingRuntimeTrust
+                Effect: Allow
+                Action:
+                  - iam:UpdateAssumeRolePolicy
+                  - iam:UpdateRole
+                  - iam:UpdateRoleDescription
+                Resource: arn:aws:iam::396287094661:role/shoc-backend-staging
               - Sid: TagStagingRuntimeRole
                 Effect: Allow
                 Action: