From 809aa3f3cf8fbed31a928319a206faead254a1af Mon Sep 17 00:00:00 2001
From: brandizzi <alex_brandizzi@hotmail.com>
Date: Thu, 30 Jul 2026 12:09:28 -0300
Subject: [PATCH] fix(cdk): allow managed environment stack update

---
 infra/cdk/README.md           | 5 +++++
 infra/cdk/deploy-dev-stack.ts | 1 +
 2 files changed, 6 insertions(+)

diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index 9c30e78..b05d16c 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -223,6 +223,11 @@ event, so `s3:DeleteObject` is scoped to the same AWS-confirmed
 `arn:aws:s3:::elasticbeanstalk-*/*` object namespace as `GetObjectAcl`. The
 policy does not grant wildcard S3 actions or access to non-Beanstalk buckets.
 
+The following rerun passed both denials and reached the delegated
+CloudFormation update, which required `cloudformation:UpdateStack`. That
+mutation is limited to the single existing Elastic Beanstalk-managed stack ARN
+for `shoc-backend-dev`; it cannot create stacks or update any other stack.
+
 The pinned deployment action can return success after Elastic Beanstalk emits a
 fatal deployment event. The following workflow step therefore verifies that
 the exact immutable version label is active and healthy before smoke testing.
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index 89e1fc3..fab7154 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -94,6 +94,7 @@ export class DeployDevStack extends cdk.Stack {
           'cloudformation:DescribeStackResources',
           'cloudformation:DescribeStacks',
           'cloudformation:ListStackResources',
+          'cloudformation:UpdateStack',
         ],
         resources: [
           `arn:aws:cloudformation:${REGION}:${ACCOUNT_ID}:stack/${ENVIRONMENT_STACK_NAME}/*`,