From 202103041cc213b0179ed6f9ac5432696b3d37f8 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Fri, 7 Aug 2026 11:09:06 -0400 Subject: [PATCH] fix(iam): allow API GW and ESM tagging for procurement-ingest Provider default_tags need apigateway /tags/* and unconditioned ESM TagResource after import-in-place. --- lib/terraform-substrate/terraform-substrate.template.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml index 11c4ac4..31fe9b9 100644 --- a/lib/terraform-substrate/terraform-substrate.template.yaml +++ b/lib/terraform-substrate/terraform-substrate.template.yaml @@ -1180,6 +1180,10 @@ Resources: Action: - lambda:GetEventSourceMapping - lambda:ListTags + # Tag/Untag on ESM UUID ARNs do not carry FunctionArn in the + # request context (provider default_tags on import). + - lambda:TagResource + - lambda:UntagResource Resource: "*" - Sid: LambdaEventSourceMappings Effect: Allow @@ -1187,8 +1191,6 @@ Resources: - lambda:CreateEventSourceMapping - lambda:DeleteEventSourceMapping - lambda:UpdateEventSourceMapping - - lambda:TagResource - - lambda:UntagResource Resource: "*" Condition: "ForAnyValue:StringLike": @@ -1308,6 +1310,8 @@ Resources: - !Sub "arn:aws:apigateway:us-east-1::/restapis/mvul1efda2/*" - arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com - arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com/* + # TagResource/UntagResource authorize against /tags/. + - arn:aws:apigateway:us-east-1::/tags/* - Sid: SesReceiptRules Effect: Allow Action: