Stand up AppWebAcl in a thin prod stack and widen seahaven-site HCP roles to read the SSM ARN so CloudFront can associate the ACL in-account.