From 46bb75166ef6164050b2fbb96919671f689746a5 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 7 Aug 2026 14:16:33 -0400
Subject: [PATCH] fix(iam): allow seahaven-site HCP roles to read GitHub OIDC
 provider

Plan refresh needs iam:GetOpenIDConnectProvider for the content-deploy
role trust data source (PLAT-91 first-plan AccessDenied).
---
 .../terraform-substrate.template.yaml                | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index eea7da1..dbe482d 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1448,6 +1448,12 @@ Resources:
                   - iam:ListRoleTags
                 Resource:
                   - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/githubdeploy-seahaven-site"
+              - Sid: RefreshGithubOidcProvider
+                Effect: Allow
+                Action:
+                  - iam:GetOpenIDConnectProvider
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
               - Sid: RefreshManagedPolicies
                 Effect: Allow
                 Action:
@@ -1507,6 +1513,12 @@ Resources:
                 Resource:
                   - arn:aws:s3:::seahaven-site-prod
                   - arn:aws:s3:::seahaven-site-prod/*
+              - Sid: ReadGithubOidcProvider
+                Effect: Allow
+                Action:
+                  - iam:GetOpenIDConnectProvider
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
               - Sid: CloudFrontManage
                 Effect: Allow
                 Action: