From ac035d66757231a5f743bc26bcafdb61146c55ef Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 14:00:13 -0400
Subject: [PATCH] fix(iam): allow staging githubdeploy GetBucketPolicy on the
 EB bucket (PLAT-148)

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 663503e..bb5df01 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -2725,6 +2725,10 @@ Resources:
             Action:
               - s3:GetBucketLocation
               - s3:ListBucket
+              - s3:GetBucketPolicy
+              - s3:GetBucketAcl
+              - s3:GetBucketVersioning
+              - s3:GetBucketOwnershipControls
             Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
           - Sid: ReadDeployParameters
             Effect: Allow