diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index e32d030..a6cf1c1 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -210,6 +210,12 @@ it intentionally does not copy the managed
 `s3:Put*`, or `s3:Delete*` grants. Any later denial must be evaluated and
 granted independently.
 
+The July 30 deployment of backend PR #41 then reached `UpdateEnvironment` and
+failed on `ec2:DescribeVpcs`. Elastic Beanstalk performs this read-only network
+discovery using the initiating role, so the CDK policy includes that action
+alongside the existing EC2 describe permissions. It remains resource `*`
+because `DescribeVpcs` does not support resource-level permissions.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index 0cdef0c..4699358 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -108,6 +108,7 @@ export class DeployDevStack extends cdk.Stack {
           'ec2:DescribeAvailabilityZones',
           'ec2:DescribeImages',
           'ec2:DescribeSubnets',
+          'ec2:DescribeVpcs',
         ],
         resources: ['*'],
       }),