From f44b88732e9e78995b7ad5d2a23ad4553df8e65a Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Fri, 7 Aug 2026 20:11:48 -0400
Subject: [PATCH] fix(iam): allow ssm:DescribeParameters for meal-order hcptf
 roles (#99)

---
 .../terraform-substrate.template.yaml               | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 2beb176..0fa6684 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1698,6 +1698,13 @@ Resources:
                 Resource:
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/waf/app-web-acl-arn"
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*"
+              # aws_ssm_parameter refresh uses DescribeParameters (collection API;
+              # resource-level parameter ARNs are a silent no-op for this action).
+              - Sid: RefreshSsmDescribeParameters
+                Effect: Allow
+                Action:
+                  - ssm:DescribeParameters
+                Resource: "*"
               - Sid: RefreshWafWebAcl
                 Effect: Allow
                 Action:
@@ -1866,6 +1873,12 @@ Resources:
                   - ssm:ListTagsForResource
                 Resource:
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*"
+              # Collection API required for aws_ssm_parameter refresh/import.
+              - Sid: MealOrderSsmDescribeParameters
+                Effect: Allow
+                Action:
+                  - ssm:DescribeParameters
+                Resource: "*"
               - Sid: ReadWafWebAcl
                 Effect: Allow
                 Action: