From f605cc035ca6756db1b94482d8ab8a93df3b7f05 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 16:06:06 -0400
Subject: [PATCH] fix(iam): allow staging HCP apply to write CloudFormation
 template buckets (PLAT-213)

---
 .../terraform-substrate.template.yaml          | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 0a23769..3c5f8ce 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3605,6 +3605,24 @@ Resources:
                   - s3:PutBucketPolicy
                   - s3:PutBucketPublicAccessBlock
                 Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
+              - Sid: ManageCloudFormationTemplates
+                Effect: Allow
+                Action:
+                  - s3:CreateBucket
+                  - s3:GetBucket*
+                  - s3:ListBucket
+                  - s3:PutBucketPolicy
+                  - s3:PutBucketOwnershipControls
+                  - s3:PutBucketPublicAccessBlock
+                  - s3:PutEncryptionConfiguration
+                Resource: arn:aws:s3:::cf-templates-*
+              - Sid: ManageCloudFormationTemplateObjects
+                Effect: Allow
+                Action:
+                  - s3:Get*
+                  - s3:Put*
+                  - s3:Delete*
+                Resource: arn:aws:s3:::cf-templates-*/*
               - Sid: PutStagingRuntimePolicy
                 Effect: Allow
                 Action: iam:PutRolePolicy