From eeabd8593403bb93088c6b8690bd8e09ed128488 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Sun, 30 Aug 2026 22:02:10 -0400
Subject: [PATCH] fix(iam): align frontend Terraform substrate

---
 cdk.json                                           | 12 ++++++------
 lib/scp/external-dev-iam-guardrails.json           |  6 ++----
 lib/terraform-substrate/shoc-frontend-resources.ts |  4 ++--
 3 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/cdk.json b/cdk.json
index 8ababef..24a4314 100644
--- a/cdk.json
+++ b/cdk.json
@@ -20,12 +20,12 @@
     "@aws-cdk/core:target-partitions": ["aws"],
     "enableShocBackendPocRoles": true,
     "enableShocBackendLiveRoles": true,
-    "enableShocFrontendPocRoles": false,
+    "enableShocFrontendPocRoles": true,
     "enableShocFrontendLiveRoles": false,
-    "shocFrontendPocDistributionId": "",
-    "shocFrontendPocOriginAccessControlId": "",
-    "shocFrontendPocFunctionName": "",
-    "shocFrontendPocHostedZoneId": "",
-    "shocFrontendPocCertificateArn": ""
+    "shocFrontendPocDistributionId": "E73KH1SPNFL00",
+    "shocFrontendPocOriginAccessControlId": "E14MP8Z5YRWO93",
+    "shocFrontendPocFunctionName": "us-east-1shocfrontendtfpocSpaRewrite4B1A4F5F",
+    "shocFrontendPocHostedZoneId": "Z10433621DH3UOWM8663D",
+    "shocFrontendPocCertificateArn": "arn:aws:acm:us-east-1:396287094661:certificate/3dbc8c23-3467-47db-9f6c-39236ca11682"
   }
 }
diff --git a/lib/scp/external-dev-iam-guardrails.json b/lib/scp/external-dev-iam-guardrails.json
index a862436..542bafe 100644
--- a/lib/scp/external-dev-iam-guardrails.json
+++ b/lib/scp/external-dev-iam-guardrails.json
@@ -23,9 +23,7 @@
       "Action": ["iam:CreatePolicyVersion", "iam:SetDefaultPolicyVersion", "iam:DeletePolicy", "iam:DeletePolicyVersion"],
       "Resource": [
         "arn:aws:iam::396287094661:policy/shoc-backend-*-boundary",
-        "arn:aws:iam::396287094661:policy/shoc-frontend-new-tf-poc-deploy-boundary",
-        "arn:aws:iam::396287094661:policy/shoc-frontend-new-dev-deploy-boundary",
-        "arn:aws:iam::396287094661:policy/shoc-frontend-new-staging-deploy-boundary"
+        "arn:aws:iam::396287094661:policy/shoc-frontend-new-*-deploy-boundary"
       ],
       "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*"] } }
     },
@@ -68,7 +66,7 @@
       "Effect": "Deny",
       "Action": ["iam:PutRolePolicy", "iam:TagRole", "iam:UntagRole"],
       "Resource": "arn:aws:iam::396287094661:role/githubdeploy-*",
-      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-*", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-tf-poc", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-staging"] } }
+      "Condition": { "ArnNotLike": { "aws:PrincipalArn": ["arn:aws:iam::396287094661:role/OrganizationAccountAccessRole", "arn:aws:iam::396287094661:role/cdk-hnb659fds-*", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-tf-poc", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-backend-staging", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-tf-poc", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-dev", "arn:aws:iam::396287094661:role/hcptf-shoc-frontend-new-staging"] } }
     },
     {
       "Sid": "DenyUnmanagedGithubRole",
diff --git a/lib/terraform-substrate/shoc-frontend-resources.ts b/lib/terraform-substrate/shoc-frontend-resources.ts
index 3ae10e5..319d549 100644
--- a/lib/terraform-substrate/shoc-frontend-resources.ts
+++ b/lib/terraform-substrate/shoc-frontend-resources.ts
@@ -144,7 +144,7 @@ const frontendReadPolicy = (
         Sid: "ReadManagedCachePolicy",
         Effect: "Allow",
         Action: "cloudfront:GetCachePolicy",
-        Resource: `arn:aws:cloudfront::aws:cache-policy/${CACHE_POLICY_ID}`,
+        Resource: `arn:aws:cloudfront::${ACCOUNT_ID}:cache-policy/${CACHE_POLICY_ID}`,
       },
       {
         Sid: "ListCachePolicies",
@@ -205,7 +205,7 @@ const frontendReadPolicy = (
       {
         Sid: "FindHostedZone",
         Effect: "Allow",
-        Action: "route53:ListHostedZonesByName",
+        Action: ["route53:ListHostedZones", "route53:ListHostedZonesByName"],
         Resource: "*",
       },
       {