From 6bb2d54814fddc981e7a9e5e3d9a8bf7d3da006f Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 10 Aug 2026 13:46:12 -0400
Subject: [PATCH] fix(iam): allow PassRole to apigateway for meal-order
 authorizer

---
 .../terraform-substrate.template.yaml                | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 2c11a7d..5199016 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1881,6 +1881,18 @@ Resources:
                 Action:
                   - ssm:DescribeParameters
                 Resource: "*"
+              # API Gateway Lambda authorizer requires PassRole to
+              # apigateway.amazonaws.com. Shared HcptfIamManagementPolicy only
+              # grants PassRole to lambda.amazonaws.com (see IAMPassRole comment).
+              - Sid: MealOrderPassRoleApiGateway
+                Effect: Allow
+                Action:
+                  - iam:PassRole
+                Resource:
+                  - !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/meal-order-manager-*"
+                Condition:
+                  StringEquals:
+                    "iam:PassedToService": "apigateway.amazonaws.com"
               - Sid: ReadWafWebAcl
                 Effect: Allow
                 Action: