From 8ec8fc4dc3d66d39893095e11f0c2c90d4c9072b Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 16:55:44 -0400
Subject: [PATCH] fix(iam): let staging HCP apply read Elastic Beanstalk
 service templates (PLAT-213)

---
 .../terraform-substrate.template.yaml                  | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 3c5f8ce..d3c4244 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3605,6 +3605,16 @@ Resources:
                   - s3:PutBucketPolicy
                   - s3:PutBucketPublicAccessBlock
                 Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
+              # Elastic Beanstalk stages the CloudFormation template for
+              # configuration UpdateStack calls in its AWS-owned regional
+              # bucket and CloudFormation fetches it with the caller's
+              # credentials. Zip deploys never touch this path.
+              - Sid: ReadBeanstalkServiceTemplates
+                Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:GetObjectVersion
+                Resource: arn:aws:s3:::elasticbeanstalk-us-east-1/*
               - Sid: ManageCloudFormationTemplates
                 Effect: Allow
                 Action: