From 6a251d49e1356daf6060ae993f615b07e882ad76 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Tue, 6 Oct 2026 12:46:08 -0400
Subject: [PATCH] fix(ci): let the runner roles read the EKS AL2023 AMI
 parameter (#187)

The managed node group plan reads the public recommended AMI version. That parameter was outside the existing SSM grant.
---
 lib/actions-runner-hcptf-stack.ts | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index db1988b..d469b61 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -304,6 +304,12 @@ function servicesPolicy(): object {
         ],
         Resource: `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/${prefix}/*`,
       },
+      {
+        Sid: "EksAmiRead",
+        Effect: "Allow",
+        Action: ["ssm:GetParameter", "ssm:GetParameters"],
+        Resource: "arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.34/amazon-linux-2023/x86_64/standard/recommended/*",
+      },
       {
         Sid: "SsmList",
         Effect: "Allow",
@@ -533,7 +539,10 @@ function planPolicy(hcpArn: string, githubArn: string): object {
         Sid: "SsmReads",
         Effect: "Allow",
         Action: ["ssm:GetParameter", "ssm:GetParameters", "ssm:ListTagsForResource"],
-        Resource: `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/actions-runner/*`,
+        Resource: [
+          `arn:aws:ssm:us-east-1:${ACCOUNT}:parameter/actions-runner/*`,
+          "arn:aws:ssm:us-east-1::parameter/aws/service/eks/optimized-ami/1.34/amazon-linux-2023/x86_64/standard/recommended/*",
+        ],
       },
     ],
   };