From 559eed1e987b3b50dd219b8d5301a8df6f2f6336 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 31 Aug 2026 17:04:00 +0000
Subject: [PATCH] fix(iam): allow backend Terraform refresh (PLAT-141) (#134)

* fix(iam): allow backend import plan reads

* fix(iam): authorize backend EB refresh

* fix(iam): authorize backend EB ownership check
---
 .../terraform-substrate.template.yaml             | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 3483108..9acf137 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3217,6 +3217,7 @@ Resources:
                 Effect: Allow
                 Action:
                   - acm:ListCertificates
+                  - autoscaling:DescribeAutoScalingGroups
                   - ec2:DescribeSecurityGroups
                   - ec2:DescribeSubnets
                   - ec2:DescribeVpcs
@@ -3227,12 +3228,26 @@ Resources:
                   - elasticbeanstalk:DescribeEnvironments
                   - elasticbeanstalk:ListTagsForResource
                   - rds:DescribeDBInstances
+                  - route53:ListHostedZones
                   - route53:ListHostedZonesByName
                 Resource: "*"
+              # Elastic Beanstalk DescribeConfigurationSettings calls
+              # CreateBucket against its existing regional service bucket
+              # during both plan and apply refresh.
+              - Sid: AuthorizeExistingEbBucketDiscovery
+                Effect: Allow
+                Action:
+                  - s3:CreateBucket
+                  - s3:PutBucketOwnershipControls
+                Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
+                Condition:
+                  StringEquals:
+                    s3:x-amz-object-ownership: ObjectWriter
               - Sid: ReadSharedCertificate
                 Effect: Allow
                 Action:
                   - acm:DescribeCertificate
+                  - acm:GetCertificate
                   - acm:ListTagsForCertificate
                 Resource: arn:aws:acm:us-east-1:396287094661:certificate/2b78e74f-7b65-4b82-a413-7a498b102f00
               - Sid: ReadSharedRdsTags