From b404de9466634587d61b568f9a3b15f3e564a6b6 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 24 Sep 2026 19:30:57 -0400
Subject: [PATCH] fix(iam): address review feedback

---
 lib/seahaven-site-hcptf-stack.ts | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/lib/seahaven-site-hcptf-stack.ts b/lib/seahaven-site-hcptf-stack.ts
index aa57cf7..a3b44af 100644
--- a/lib/seahaven-site-hcptf-stack.ts
+++ b/lib/seahaven-site-hcptf-stack.ts
@@ -60,7 +60,16 @@ export class SeahavenSiteHcptfStack extends cdk.Stack {
       policies: [
         {
           policyName: "seahaven-site-plan-refresh",
-          policyDocument: planPolicy(account, bucket, functionArn, deployParams, wafParam, githubOidc, deployRole),
+          policyDocument: planPolicy(
+            account,
+            bucket,
+            functionArn,
+            deployParams,
+            wafParam,
+            githubOidc,
+            deployRole,
+            boundary,
+          ),
         },
       ],
       tags: roleTags(),
@@ -251,7 +260,10 @@ function scopedIamPolicy(account: string, deployRole: string, boundary: string):
           "iam:DeletePolicyVersion",
           "iam:GetPolicy",
           "iam:GetPolicyVersion",
+          "iam:ListPolicyTags",
+          "iam:SetDefaultPolicyVersion",
           "iam:TagPolicy",
+          "iam:UntagPolicy",
         ],
         Resource: boundary,
       },
@@ -349,6 +361,7 @@ function planPolicy(
   wafParam: string,
   githubOidc: string,
   deployRole: string,
+  boundary: string,
 ): iam.PolicyDocument {
   return iam.PolicyDocument.fromJson({
     Version: "2012-10-17",
@@ -381,6 +394,12 @@ function planPolicy(
         Action: ["iam:GetPolicy", "iam:GetPolicyVersion"],
         Resource: "*",
       },
+      {
+        Sid: "RefreshDeployBoundaryTags",
+        Effect: "Allow",
+        Action: "iam:ListPolicyTags",
+        Resource: boundary,
+      },
       {
         Sid: "RefreshOriginBucket",
         Effect: "Allow",