From 4b1f066040438526c04e82c34290e1d003929f24 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 15:36:24 -0400
Subject: [PATCH] fix(iam): allow staging HCP apply to use the Elastic
 Beanstalk bucket (PLAT-213)

---
 .../terraform-substrate.template.yaml         | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 6db95a7..bdc7edc 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3589,6 +3589,25 @@ Resources:
                   - autoscaling:ResumeProcesses
                   - autoscaling:SuspendProcesses
                 Resource: arn:aws:autoscaling:us-east-1:396287094661:autoScalingGroup:*:autoScalingGroupName/awseb-e-6c9m4vb62z-stack-*
+              - Sid: UseStagingBeanstalkBucket
+                Effect: Allow
+                Action:
+                  - s3:GetBucketLocation
+                  - s3:ListBucket
+                  - s3:GetBucketPolicy
+                  - s3:GetBucketAcl
+                  - s3:GetBucketVersioning
+                  - s3:GetBucketOwnershipControls
+                Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
+              - Sid: ManageStagingEnvironmentObjects
+                Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:PutObject
+                  - s3:DeleteObject
+                Resource:
+                  - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/environments/e-6c9m4vb62z/*
+                  - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/_runtime/_embedded_extensions/shoc-backend/*
               - Sid: PutStagingRuntimePolicy
                 Effect: Allow
                 Action: iam:PutRolePolicy