From 400ba097701af9bcfef6287890665893872762b9 Mon Sep 17 00:00:00 2001
From: Alexandre Brandizzi <alex_brandizzi@hotmail.com>
Date: Tue, 28 Jul 2026 14:30:48 -0300
Subject: [PATCH] fix(cdk): scope EB platform ACL read

---
 infra/cdk/README.md           | 19 +++++++++++--------
 infra/cdk/deploy-dev-stack.ts |  7 ++++++-
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index 6e27be7..0dc802d 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -117,14 +117,17 @@ The role grants only:
   Elastic Beanstalk emitted this read during the same attempt while validating
   the uploaded application bundle. It grants no bucket-wide or cross-prefix
   object access.
-- `s3:GetObjectAcl` on only
-  `resources/environments/e-hehnrqjjrt/_runtime/*` in the same bucket. A
-  successful break-glass deployment showed that EB copies each immutable
-  application version, its embedded extensions, and its manifest under that
-  exact environment runtime prefix. The failed OIDC path already allowed the
-  source object, so the remaining ACL validation is limited to that proven
-  runtime boundary. This grant exposes ACL metadata only; it does not grant
-  runtime content reads or writes.
+- `s3:GetObjectAcl` on only the active Elastic Beanstalk platform version
+  prefix
+  `elasticbeanstalk-platform-assets-us-east-1/stalks/eb_dotnet8_amazon_linux_2023_1.0.2939.0_20260625064821/*`.
+  The live environment stack references its platform configuration, hooks,
+  user-data script, and sample bundle under that exact AWS-owned prefix. An
+  audited account-bucket data-event trail captured source-bundle ACL reads but
+  did not capture the remaining denied ACL read, which rules out the previous
+  account-owned runtime-prefix inference. The grant therefore covers only ACL
+  metadata for the environment's currently deployed platform version; it
+  grants no platform object content read or write, no adjacent platform
+  version, and no account-owned runtime object access.
 
 It grants **no** IAM mutation or `PassRole`, **no** RDS / Secrets Manager
 access, no EC2 mutation, and **no** administrator policy. The only non-EB/S3
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index bd56198..0d8bbfb 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -10,6 +10,9 @@ const ENVIRONMENT_ID = 'e-hehnrqjjrt';
 const ENVIRONMENT_STACK_NAME = `awseb-${ENVIRONMENT_ID}-stack`;
 const REPO = 'Sea-Haven-Industries/shoc-backend';
 const BUCKET_NAME = `elasticbeanstalk-${REGION}-${ACCOUNT_ID}`;
+const PLATFORM_ASSET_BUCKET_NAME = `elasticbeanstalk-platform-assets-${REGION}`;
+const PLATFORM_ASSET_PREFIX =
+  'stalks/eb_dotnet8_amazon_linux_2023_1.0.2939.0_20260625064821';
 
 export class DeployDevStack extends cdk.Stack {
   constructor(scope: Construct, id: string, props: cdk.StackProps = {}) {
@@ -151,7 +154,9 @@ export class DeployDevStack extends cdk.Stack {
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
         actions: ['s3:GetObjectAcl'],
-        resources: [`${bucketArn}/resources/environments/${ENVIRONMENT_ID}/_runtime/*`],
+        resources: [
+          `arn:aws:s3:::${PLATFORM_ASSET_BUCKET_NAME}/${PLATFORM_ASSET_PREFIX}/*`,
+        ],
       }),
     );