From 3512214d14932f58cb18c4958bb88a15dc0d8dca Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 5 Aug 2026 12:56:24 -0400
Subject: [PATCH] fix(iam): allow s3:* on afi artifact bucket for provider
 reads

First HCP apply failed on s3:GetBucketAcl after CreateBucket; scope
remains the single artifact bucket ARN.
---
 .../terraform-substrate.template.yaml         | 22 +++++--------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index ff90bf3..5df4dde 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -498,26 +498,14 @@ Resources:
                 Resource: "*"
               # Artifact bucket for HCP plan/apply split: zip bytes travel in the
               # plan via aws_s3_object content_base64 (local archive_file paths
-              # from the plan worker are not on the apply worker).
+              # from the plan worker are not on the apply worker). Action set is
+              # s3:* on this bucket only — the AWS provider reads many GetBucket*
+              # attributes (e.g. GetBucketAcl) after CreateBucket; enumerating
+              # them lags provider upgrades (PLAT-56 first-apply miss).
               - Sid: LambdaArtifactsBucket
                 Effect: Allow
                 Action:
-                  - s3:CreateBucket
-                  - s3:DeleteBucket
-                  - s3:GetBucketLocation
-                  - s3:GetBucketPolicy
-                  - s3:PutBucketPolicy
-                  - s3:DeleteBucketPolicy
-                  - s3:GetBucketVersioning
-                  - s3:PutBucketVersioning
-                  - s3:GetBucketPublicAccessBlock
-                  - s3:PutBucketPublicAccessBlock
-                  - s3:GetBucketTagging
-                  - s3:PutBucketTagging
-                  - s3:ListBucket
-                  - s3:GetObject
-                  - s3:PutObject
-                  - s3:DeleteObject
+                  - s3:*
                 Resource:
                   - !Sub "arn:aws:s3:::afi-backup-monitor-artifacts-${AWS::AccountId}"
                   - !Sub "arn:aws:s3:::afi-backup-monitor-artifacts-${AWS::AccountId}/*"