From a9fd8d0227f29eaa29af28012333416ba4e3c911 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 6 Aug 2026 17:05:22 -0400
Subject: [PATCH] fix(iam): tighten procurement-ingest apply-role scopes
 (PLAT-86)

---
 .../terraform-substrate.template.yaml         | 37 ++++++++++++++++---
 1 file changed, 31 insertions(+), 6 deletions(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 5855b1d..751fe15 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1139,7 +1139,26 @@ Resources:
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:po-*"
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:workorder-*"
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:procurement-api"
-                  - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:event-source-mapping:*"
+              # Event source mapping ARNs are UUID-keyed; AWS authorises Create against
+              # FunctionArn. Get/Update/Delete also take the mapping ARN, so Resource
+              # stays "*" but FunctionArn is constrained to this stack's functions.
+              - Sid: LambdaEventSourceMappings
+                Effect: Allow
+                Action:
+                  - lambda:CreateEventSourceMapping
+                  - lambda:DeleteEventSourceMapping
+                  - lambda:UpdateEventSourceMapping
+                  - lambda:GetEventSourceMapping
+                  - lambda:ListTags
+                  - lambda:TagResource
+                  - lambda:UntagResource
+                Resource: "*"
+                Condition:
+                  "ForAnyValue:StringLike":
+                    "lambda:FunctionArn":
+                      - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:po-*"
+                      - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:workorder-*"
+                      - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:procurement-api"
               - Sid: LambdaList
                 Effect: Allow
                 Action:
@@ -1240,10 +1259,10 @@ Resources:
                 Action:
                   - apigateway:*
                 Resource:
-                  - !Sub "arn:aws:apigateway:us-east-1::/restapis"
-                  - !Sub "arn:aws:apigateway:us-east-1::/restapis/*"
-                  - arn:aws:apigateway:us-east-1::/domainnames
-                  - arn:aws:apigateway:us-east-1::/domainnames/*
+                  - !Sub "arn:aws:apigateway:us-east-1::/restapis/mvul1efda2"
+                  - !Sub "arn:aws:apigateway:us-east-1::/restapis/mvul1efda2/*"
+                  - arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com
+                  - arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com/*
               - Sid: SesReceiptRules
                 Effect: Allow
                 Action:
@@ -1251,8 +1270,14 @@ Resources:
                   - ses:UpdateReceiptRule
                   - ses:DeleteReceiptRule
                   - ses:DescribeReceiptRule
-                  - ses:DescribeReceiptRuleSet
                   - ses:SetReceiptRulePosition
+                Resource:
+                  - !Sub "arn:aws:ses:us-east-1:${AWS::AccountId}:receipt-rule-set/INBOUND_MAIL:receipt-rule/ExistingRuleSetPoEmailRuleAC8E9C87-qwGDj9lBoL1G"
+                  - !Sub "arn:aws:ses:us-east-1:${AWS::AccountId}:receipt-rule-set/INBOUND_MAIL:receipt-rule/ExistingRuleSetWorkorderEmailRuleEA29F845-PKtaDBvIg61a"
+              - Sid: SesDescribeRuleSet
+                Effect: Allow
+                Action:
+                  - ses:DescribeReceiptRuleSet
                 Resource: "*"
               - Sid: ShocKms
                 Effect: Allow