From d54d7f0aa28524bd9e87b003a0f97a50828f9848 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 13:37:18 -0400
Subject: [PATCH] fix(iam): scope staging githubdeploy S3 object access to the
 EB bucket (PLAT-148)

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 9131ea2..13a4316 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -2717,8 +2717,8 @@ Resources:
               - s3:GetObjectVersionAcl
               - s3:DeleteObject
             Resource:
-              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/shoc-backend/*
-              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/*
+              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
+              - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/*
           - Sid: UseBeanstalkBucket
             Effect: Allow
             Action: