From e12944a42dd6466ad8cb5aabef99e19f4c2f3ed5 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Fri, 7 Aug 2026 14:20:40 -0400
Subject: [PATCH] fix(iam): allow kebab WO tables on lambda execution boundary
 (#90)

Widen ProcurementIngestDynamoDB so workorder Lambdas can read/write
work-orders and work-order-comments after the PLAT-11 rename.
---
 lib/deploy-substrate/deploy-substrate.template.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/deploy-substrate/deploy-substrate.template.yaml b/lib/deploy-substrate/deploy-substrate.template.yaml
index 7558b6d..a50b5eb 100644
--- a/lib/deploy-substrate/deploy-substrate.template.yaml
+++ b/lib/deploy-substrate/deploy-substrate.template.yaml
@@ -586,6 +586,10 @@ Resources:
                 - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrders/*"
                 - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments"
                 - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments/*"
+                - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders"
+                - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders/*"
+                - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments"
+                - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments/*"
             - !Ref AWS::NoValue
           - !If
             - IsProdAccount