From 1bb5e79ea0fe0bb8516d5ae2d60ddce60ba85a36 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 10 Aug 2026 13:23:56 -0400
Subject: [PATCH] fix(iam): allow ssm:ListTagsForResource on meal-order plan
 role

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 0fa6684..2c11a7d 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1695,6 +1695,8 @@ Resources:
                 Action:
                   - ssm:GetParameter
                   - ssm:GetParameters
+                  # aws_ssm_parameter refresh lists tags on managed parameters.
+                  - ssm:ListTagsForResource
                 Resource:
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/waf/app-web-acl-arn"
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*"