From e10462d25e8e68464049f826f49278898c102efd Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 10 Aug 2026 14:47:30 -0400
Subject: [PATCH] fix(iam): allow API GW Log Delivery on meal-order apply role

---
 .../terraform-substrate.template.yaml             | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 5199016..331d86f 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1791,6 +1791,21 @@ Resources:
                 Action:
                   - logs:DescribeLogGroups
                 Resource: "*"
+              # HTTP API stage access_log_settings uses the Log Delivery APIs.
+              # These are account-level (Resource "*"); scoped log-group ARNs
+              # above are insufficient. Mirrors deploy-substrate
+              # cloudwatch-logs-management LogDelivery actions.
+              - Sid: MealOrderApiGwAccessLogDelivery
+                Effect: Allow
+                Action:
+                  - logs:CreateLogDelivery
+                  - logs:GetLogDelivery
+                  - logs:UpdateLogDelivery
+                  - logs:DeleteLogDelivery
+                  - logs:ListLogDeliveries
+                  - logs:PutResourcePolicy
+                  - logs:DescribeResourcePolicies
+                Resource: "*"
               - Sid: StackBuckets
                 Effect: Allow
                 Action: