From 6fa6277808477e0fc14a217d57f724cdf04abe6c Mon Sep 17 00:00:00 2001
From: brandizzi <alex_brandizzi@hotmail.com>
Date: Thu, 30 Jul 2026 12:26:16 -0300
Subject: [PATCH] fix(cdk): allow load balancer discovery and cancel

---
 infra/cdk/README.md           | 14 ++++++++++----
 infra/cdk/deploy-dev-stack.ts |  9 +++++++++
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index 95c687c..7b8a508 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -191,10 +191,11 @@ All commands run from `infra/cdk/`.
 - Trust policy `StringEquals` matches the exact audience and subject above.
 - The inline policy contains no `Resource: "*"` mutation action and no service
   outside `elasticbeanstalk` / `s3` / `cloudformation` / `ec2` /
-  `autoscaling`. CloudFormation discovery is limited to the single EB-managed
-  stack prefix. EC2 and Auto Scaling discovery use `Resource: "*"` only where
-  the IAM resource model requires it; Auto Scaling mutations are limited to
-  this environment's ASG name pattern.
+  `elasticloadbalancing` / `autoscaling`. CloudFormation discovery and
+  mutations are limited to the single EB-managed stack prefix. EC2, Elastic
+  Load Balancing, and Auto Scaling discovery use `Resource: "*"` only where the
+  IAM resource model requires it; Auto Scaling mutations are limited to this
+  environment's ASG name pattern.
 
 The workflow's `AWS_DEPLOY_ROLE_ARN` repository secret (environment `dev`) must
 hold the ARN output by this stack (`GithubDeployRoleArn`).
@@ -232,6 +233,11 @@ is granted to non-Elastic-Beanstalk bucket names. The CloudFormation mutation
 remains limited to the single existing `shoc-backend-dev` managed stack ARN; it
 cannot create stacks or update another stack.
 
+The next rerun cleared S3 and then required the read-only
+`elasticloadbalancing:DescribeLoadBalancers` discovery action. Its failed
+managed-stack update also required `cloudformation:CancelUpdateStack`; the
+cancel action is scoped to the same single stack ARN as `UpdateStack`.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index d6f14e4..107e046 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -80,6 +80,7 @@ export class DeployDevStack extends cdk.Stack {
           'cloudformation:DescribeStackResources',
           'cloudformation:DescribeStacks',
           'cloudformation:ListStackResources',
+          'cloudformation:CancelUpdateStack',
           'cloudformation:UpdateStack',
         ],
         resources: [
@@ -101,6 +102,14 @@ export class DeployDevStack extends cdk.Stack {
       }),
     );
 
+    deployRole.addToPolicy(
+      new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        actions: ['elasticloadbalancing:DescribeLoadBalancers'],
+        resources: ['*'],
+      }),
+    );
+
     deployRole.addToPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,