From 21f231e29d93f662fa676fe90671695f241cd813 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 5 Aug 2026 18:35:30 -0400
Subject: [PATCH] fix(iam): pin CreateSecret to exact export secret name

Remove CreateSecret and UpdateSecret from the ARN-prefix shell grant so
apply cannot create longer-named secrets or overwrite SecretString.
---
 .../terraform-substrate.template.yaml                    | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 200def8..bdbb6de 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -891,12 +891,14 @@ Resources:
                   - iam:ListUsers
                   - iam:GetAccountSummary
                 Resource: "*"
-              # Shell lifecycle only — no GetSecretValue / PutSecretValue so
-              # apply never renders key material into HCP state or run logs.
+              # Shell lifecycle only — no GetSecretValue / PutSecretValue /
+              # UpdateSecret so apply never renders or overwrites key material
+              # in HCP state or run logs. CreateSecret is only on
+              # ExportSecretCreate with an exact Name pin (not this ARN
+              # prefix, which would also match longer secret names).
               - Sid: ExportSecretShell
                 Effect: Allow
                 Action:
-                  - secretsmanager:CreateSecret
                   - secretsmanager:DeleteSecret
                   - secretsmanager:DescribeSecret
                   - secretsmanager:GetResourcePolicy
@@ -904,7 +906,6 @@ Resources:
                   - secretsmanager:DeleteResourcePolicy
                   - secretsmanager:TagResource
                   - secretsmanager:UntagResource
-                  - secretsmanager:UpdateSecret
                 Resource:
                   - !Sub "arn:aws:secretsmanager:us-east-1:${AWS::AccountId}:secret:sh-openswe/langsmith-export-s3-*"
               - Sid: ExportSecretCreate