From 7348ab98453b8057c5c532ae459489f0c12ea4e4 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 27 Aug 2026 17:40:05 -0400
Subject: [PATCH] fix(iam): split paychex plan lambda list onto Resource *

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index f6801eb..2a33bac 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -792,9 +792,15 @@ Resources:
                 Effect: Allow
                 Action:
                   - lambda:Get*
-                  - lambda:List*
                 Resource:
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:paychex-*"
+              # Collection/list APIs authorize only against Resource "*".
+              - Sid: RefreshLambdaList
+                Effect: Allow
+                Action:
+                  - lambda:ListFunctions
+                  - lambda:GetAccountSettings
+                Resource: "*"
               - Sid: RefreshArtifactsBucket
                 Effect: Allow
                 Action: