From 23d954369df26a7e809fd75aa5eccf76b3961e60 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Thu, 27 Aug 2026 22:43:48 +0000
Subject: [PATCH] fix(iam): allow door-unlock apply to create api domain (#126)

CreateDomainName authorizes against the /domainnames collection, so the hostname-pinned ARN cannot complete first apply.
---
 lib/terraform-substrate/terraform-substrate.template.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 52a0e1d..c57747e 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -2387,6 +2387,14 @@ Resources:
                   - !Sub "arn:aws:apigateway:us-east-1::/apis"
                   - !Sub "arn:aws:apigateway:us-east-1::/apis/*"
                   - !Sub "arn:aws:apigateway:us-east-1::/tags/*"
+              # CreateDomainName POSTs to the collection ARN. Hostname ARNs
+              # cover Get/Update/Delete and apiMappings after create.
+              - Sid: HttpApiDomainCreate
+                Effect: Allow
+                Action:
+                  - apigateway:POST
+                Resource:
+                  - arn:aws:apigateway:us-east-1::/domainnames
               - Sid: HttpApiDomain
                 Effect: Allow
                 Action: