From af0ab71eb5c686539827bd047bce1dd9e180257f Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 13:04:55 -0400
Subject: [PATCH] fix(iam): allow staging githubdeploy to GetObject release
 zips (PLAT-148)

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 0862c8b..7e524ca 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -2708,7 +2708,9 @@ Resources:
             Resource: arn:aws:autoscaling:us-east-1:396287094661:autoScalingGroup:*:autoScalingGroupName/awseb-e-6c9m4vb62z-stack-*
           - Sid: UploadApplicationVersion
             Effect: Allow
-            Action: s3:PutObject
+            Action:
+              - s3:PutObject
+              - s3:GetObject
             Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/shoc-backend/*
           - Sid: UseBeanstalkBucket
             Effect: Allow