From ea273cddf1f1ed520682d31baf32f0cdafd06a51 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 13:16:07 -0400
Subject: [PATCH] fix(iam): allow staging githubdeploy GetObjectAcl on release
 zips (PLAT-148)

---
 lib/terraform-substrate/terraform-substrate.template.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 82bf150..9ff813f 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -2711,6 +2711,7 @@ Resources:
             Action:
               - s3:PutObject
               - s3:GetObject
+              - s3:GetObjectAcl
             Resource:
               - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/shoc-backend/*
               - arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661/resources/_runtime/_embedded_extensions/shoc-backend/*