fix(iam): allow site plan role to describe CF function (PLAT-106)

2026-09-30 06:53:17 +00:00 · 2026-08-20 15:22:09 -04:00 · 2026-08-20 15:22:09 -04:00 · 9bffddfd7b
commit 9bffddfd7b
parent e2b4b635e3
1 changed files with 8 additions and 0 deletions
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@ -1472,6 +1472,14 @@ Resources:
                  - cloudfront:Get*
                  - cloudfront:List*
                Resource: "*"
+              # aws_cloudfront_function refresh reads DEVELOPMENT via
+              # DescribeFunction. Get* does not cover that API (PLAT-106).
+              - Sid: RefreshCloudFrontFunction
+                Effect: Allow
+                Action:
+                  - cloudfront:DescribeFunction
+                Resource:
+                  - !Sub "arn:aws:cloudfront::${AWS::AccountId}:function/seahaven-site-prod-directory-index"
              - Sid: RefreshAcm
                Effect: Allow
                Action: