diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index 7b8a508..d4dab94 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -238,6 +238,13 @@ The next rerun cleared S3 and then required the read-only
 managed-stack update also required `cloudformation:CancelUpdateStack`; the
 cancel action is scoped to the same single stack ARN as `UpdateStack`.
 
+The subsequent rerun progressed into Auto Scaling and required
+`autoscaling:DescribeLaunchConfigurations`. Because Elastic Beanstalk's
+managed update workflow performs variable resource discovery, the role follows
+the documented read-only discovery families for EC2, Elastic Load Balancing,
+and Auto Scaling (`Describe*`). These grants expose metadata across the account
+but do not authorize any mutation; write actions remain separately scoped.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index 107e046..6ec101d 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -43,9 +43,12 @@ export class DeployDevStack extends cdk.Stack {
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
         actions: [
+          'autoscaling:Describe*',
+          'ec2:Describe*',
           'elasticbeanstalk:DescribeEnvironments',
           'elasticbeanstalk:DescribeApplicationVersions',
           'elasticbeanstalk:DescribeEvents',
+          'elasticloadbalancing:Describe*',
         ],
         resources: ['*'],
       }),
@@ -89,38 +92,6 @@ export class DeployDevStack extends cdk.Stack {
       }),
     );
 
-    deployRole.addToPolicy(
-      new iam.PolicyStatement({
-        effect: iam.Effect.ALLOW,
-        actions: [
-          'ec2:DescribeAvailabilityZones',
-          'ec2:DescribeImages',
-          'ec2:DescribeSubnets',
-          'ec2:DescribeVpcs',
-        ],
-        resources: ['*'],
-      }),
-    );
-
-    deployRole.addToPolicy(
-      new iam.PolicyStatement({
-        effect: iam.Effect.ALLOW,
-        actions: ['elasticloadbalancing:DescribeLoadBalancers'],
-        resources: ['*'],
-      }),
-    );
-
-    deployRole.addToPolicy(
-      new iam.PolicyStatement({
-        effect: iam.Effect.ALLOW,
-        actions: [
-          'autoscaling:DescribeAutoScalingGroups',
-          'autoscaling:DescribeScalingActivities',
-        ],
-        resources: ['*'],
-      }),
-    );
-
     deployRole.addToPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,