From 6ad171e5da48bdde5ff437d3520faba54f6556af Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 14:06:42 -0400
Subject: [PATCH] fix(iam): scope staging githubdeploy S3 objects to SHOC and
 staging EB prefixes (PLAT-148)

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index bb5df01..3667122 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -2718,8 +2718,9 @@ Resources:
               - s3:GetObjectVersionAcl
               - s3:DeleteObject
             Resource:
-              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
-              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/*
+              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/shoc-backend/*
+              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/_runtime/_embedded_extensions/shoc-backend/*
+              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/environments/e-6c9m4vb62z/*
           - Sid: UseBeanstalkBucket
             Effect: Allow
             Action: