From ff77ffd4219936cfffc24cb4403e13a33b8366e6 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Fri, 7 Aug 2026 13:53:42 -0400
Subject: [PATCH] fix(iam): allow HCP procurement-ingest kebab WO Dynamo tables
 (#88)

Widen hcptf-procurement-ingest apply and plan-refresh DynamoDB/CloudWatch
ARN pins for work-orders and work-order-comments (PLAT-11 rename).
---
 .../terraform-substrate.template.yaml                | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 31fe9b9..2cbd0c6 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1051,6 +1051,10 @@ Resources:
                   - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrders/*"
                   - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments"
                   - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments/*"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders/*"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments/*"
               - Sid: RefreshDynamoDBList
                 Effect: Allow
                 Action:
@@ -1081,6 +1085,8 @@ Resources:
                   - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:pending-site-review-*"
                   - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:WorkOrders-*"
                   - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:WorkOrderComments-*"
+                  - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:work-orders-*"
+                  - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:work-order-comments-*"
               - Sid: RefreshApiGateway
                 Effect: Allow
                 Action:
@@ -1266,6 +1272,10 @@ Resources:
                   - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrders/*"
                   - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments"
                   - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/WorkOrderComments/*"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-orders/*"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments"
+                  - !Sub "arn:aws:dynamodb:us-east-1:${AWS::AccountId}:table/work-order-comments/*"
               - Sid: DynamoDBList
                 Effect: Allow
                 Action:
@@ -1293,6 +1303,8 @@ Resources:
                   - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:pending-site-review-*"
                   - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:WorkOrders-*"
                   - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:WorkOrderComments-*"
+                  - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:work-orders-*"
+                  - !Sub "arn:aws:cloudwatch:us-east-1:${AWS::AccountId}:alarm:work-order-comments-*"
               - Sid: SiteAlertsSns
                 Effect: Allow
                 Action: