From 50b8fd2d414e7b8b5060107f9f15e4c10972687e Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 15:21:40 -0400
Subject: [PATCH] fix(iam): allow staging HCP apply to update the SHOC backend
 EB stack (PLAT-213)

---
 .../terraform-substrate.template.yaml         | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 3667122..6db95a7 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3563,6 +3563,32 @@ Resources:
                   - elasticbeanstalk:UpdateEnvironment
                   - elasticbeanstalk:UpdateTagsForResource
                 Resource: arn:aws:elasticbeanstalk:us-east-1:396287094661:environment/shoc-backend/shoc-backend-staging
+              - Sid: ManageStagingEnvironmentStack
+                Effect: Allow
+                Action:
+                  - cloudformation:CancelUpdateStack
+                  - cloudformation:DescribeStackEvents
+                  - cloudformation:DescribeStackResource
+                  - cloudformation:DescribeStackResources
+                  - cloudformation:DescribeStacks
+                  - cloudformation:GetTemplate
+                  - cloudformation:ListStackResources
+                  - cloudformation:UpdateStack
+                Resource: arn:aws:cloudformation:us-east-1:396287094661:stack/awseb-e-6c9m4vb62z-stack/*
+              - Sid: DescribeDeploymentResources
+                Effect: Allow
+                Action:
+                  - autoscaling:Describe*
+                  - ec2:Describe*
+                  - elasticloadbalancing:Describe*
+                Resource: "*"
+              - Sid: ManageStagingEnvironmentAsg
+                Effect: Allow
+                Action:
+                  - autoscaling:PutNotificationConfiguration
+                  - autoscaling:ResumeProcesses
+                  - autoscaling:SuspendProcesses
+                Resource: arn:aws:autoscaling:us-east-1:396287094661:autoScalingGroup:*:autoScalingGroupName/awseb-e-6c9m4vb62z-stack-*
               - Sid: PutStagingRuntimePolicy
                 Effect: Allow
                 Action: iam:PutRolePolicy