fix(cdk): allow load balancer discovery and cancel

infra/cdk/README.md

@@ -191,10 +191,11 @@ All commands run from `infra/cdk/`.
 - Trust policy `StringEquals` matches the exact audience and subject above.
 - The inline policy contains no `Resource: "*"` mutation action and no service
   outside `elasticbeanstalk` / `s3` / `cloudformation` / `ec2` /
-  `autoscaling`. CloudFormation discovery is limited to the single EB-managed
+  `elasticloadbalancing` / `autoscaling`. CloudFormation discovery and
-  stack prefix. EC2 and Auto Scaling discovery use `Resource: "*"` only where
+  mutations are limited to the single EB-managed stack prefix. EC2, Elastic
-  the IAM resource model requires it; Auto Scaling mutations are limited to
+  Load Balancing, and Auto Scaling discovery use `Resource: "*"` only where the
-  this environment's ASG name pattern.
+  IAM resource model requires it; Auto Scaling mutations are limited to this
+  environment's ASG name pattern.
 
 The workflow's `AWS_DEPLOY_ROLE_ARN` repository secret (environment `dev`) must
 hold the ARN output by this stack (`GithubDeployRoleArn`).
@@ -232,6 +233,11 @@ is granted to non-Elastic-Beanstalk bucket names. The CloudFormation mutation
 remains limited to the single existing `shoc-backend-dev` managed stack ARN; it
 cannot create stacks or update another stack.
 
+The next rerun cleared S3 and then required the read-only
+`elasticloadbalancing:DescribeLoadBalancers` discovery action. Its failed
+managed-stack update also required `cloudformation:CancelUpdateStack`; the
+cancel action is scoped to the same single stack ARN as `UpdateStack`.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.

infra/cdk/deploy-dev-stack.ts

@@ -80,6 +80,7 @@ export class DeployDevStack extends cdk.Stack {
           'cloudformation:DescribeStackResources',
           'cloudformation:DescribeStacks',
           'cloudformation:ListStackResources',
+          'cloudformation:CancelUpdateStack',
           'cloudformation:UpdateStack',
         ],
         resources: [
@@ -101,6 +102,14 @@ export class DeployDevStack extends cdk.Stack {
       }),
     );
 
+    deployRole.addToPolicy(
+      new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        actions: ['elasticloadbalancing:DescribeLoadBalancers'],
+        resources: ['*'],
+      }),
+    );
+
     deployRole.addToPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,