From e1e360d10087dcbdc8414950e016299df6324bc2 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 15:42:23 -0400
Subject: [PATCH] fix(iam): allow staging HCP apply to copy the current release
 zip (PLAT-213)

---
 .../terraform-substrate.template.yaml                  | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index bdc7edc..00c8063 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3599,11 +3599,21 @@ Resources:
                   - s3:GetBucketVersioning
                   - s3:GetBucketOwnershipControls
                 Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
+              - Sid: ReadStagingReleaseZips
+                Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:GetObjectAcl
+                  - s3:GetObjectVersion
+                  - s3:GetObjectVersionAcl
+                Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/shoc-backend/releases/staging/*
               - Sid: ManageStagingEnvironmentObjects
                 Effect: Allow
                 Action:
                   - s3:GetObject
+                  - s3:GetObjectAcl
                   - s3:PutObject
+                  - s3:PutObjectAcl
                   - s3:DeleteObject
                 Resource:
                   - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/environments/e-6c9m4vb62z/*