From a5de37e568a29776a2fd6a0887a505adbce24066 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 13:10:52 -0400
Subject: [PATCH] fix(iam): allow staging githubdeploy to write EB processed
 extensions (PLAT-148)

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 7e524ca..82bf150 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -2711,7 +2711,9 @@ Resources:
             Action:
               - s3:PutObject
               - s3:GetObject
-            Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/shoc-backend/*
+            Resource:
+              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/shoc-backend/*
+              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/_runtime/_embedded_extensions/shoc-backend/*
           - Sid: UseBeanstalkBucket
             Effect: Allow
             Action: