fix(iam): codify live terraform-substrate IAM (PLAT-142) (#135)

* fix(iam): allow frontend import plan to read deploy boundaries

* fix(iam): grant backend apply role EB UpdateEnvironment follow-on perms

lib/terraform-substrate/shoc-frontend-resources.ts

@@ -164,6 +164,12 @@ const frontendReadPolicy = (
         ],
         Resource: roleArn(environment.deployRoleName),
       },
+      {
+        Sid: "ReadExactDeployBoundary",
+        Effect: "Allow",
+        Action: ["iam:GetPolicy", "iam:GetPolicyVersion"],
+        Resource: `arn:aws:iam::${ACCOUNT_ID}:policy/shoc-frontend-new-${environment.key}-deploy-boundary`,
+      },
       {
         Sid: "ReadGithubOidcProvider",
         Effect: "Allow",

lib/terraform-substrate/terraform-substrate.template.yaml

@@ -3308,6 +3308,48 @@ Resources:
                   - elasticbeanstalk:UpdateEnvironment
                   - elasticbeanstalk:UpdateTagsForResource
                 Resource: arn:aws:elasticbeanstalk:us-east-1:396287094661:environment/shoc-backend/shoc-backend-dev
+              - Sid: ManageDevEnvironmentStack
+                Effect: Allow
+                Action:
+                  - cloudformation:CancelUpdateStack
+                  - cloudformation:DescribeStackEvents
+                  - cloudformation:DescribeStackResource
+                  - cloudformation:DescribeStackResources
+                  - cloudformation:DescribeStacks
+                  - cloudformation:GetTemplate
+                  - cloudformation:ListStackResources
+                  - cloudformation:UpdateStack
+                Resource: arn:aws:cloudformation:us-east-1:396287094661:stack/awseb-e-hehnrqjjrt-stack/*
+              - Sid: DescribeDeploymentResources
+                Effect: Allow
+                Action:
+                  - autoscaling:Describe*
+                  - ec2:Describe*
+                  - elasticloadbalancing:Describe*
+                Resource: "*"
+              - Sid: ManageDevEnvironmentAsg
+                Effect: Allow
+                Action:
+                  - autoscaling:PutNotificationConfiguration
+                  - autoscaling:ResumeProcesses
+                  - autoscaling:SuspendProcesses
+                Resource: arn:aws:autoscaling:us-east-1:396287094661:autoScalingGroup:*:autoScalingGroupName/awseb-e-hehnrqjjrt-stack-*
+              - Sid: LegacyBeanstalkObjects
+                Effect: Allow
+                Action:
+                  - s3:Delete*
+                  - s3:Get*
+                  - s3:Put*
+                Resource: arn:aws:s3:::elasticbeanstalk-*/*
+              - Sid: LegacyBeanstalkBuckets
+                Effect: Allow
+                Action:
+                  - s3:GetBucket*
+                  - s3:ListBucket
+                  - s3:PutBucketOwnershipControls
+                  - s3:PutBucketPolicy
+                  - s3:PutBucketPublicAccessBlock
+                Resource: arn:aws:s3:::elasticbeanstalk-*
               - Sid: PutDevRuntimePolicy
                 Effect: Allow
                 Action: iam:PutRolePolicy