From 9966c222408c2a44869fe785c555bb332de5cdaf Mon Sep 17 00:00:00 2001 From: brandizzi Date: Thu, 30 Jul 2026 12:15:21 -0300 Subject: [PATCH] fix(cdk): allow Beanstalk template read --- infra/cdk/README.md | 5 +++++ infra/cdk/deploy-dev-stack.ts | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/infra/cdk/README.md b/infra/cdk/README.md index b05d16c..1d11f47 100644 --- a/infra/cdk/README.md +++ b/infra/cdk/README.md @@ -228,6 +228,11 @@ CloudFormation update, which required `cloudformation:UpdateStack`. That mutation is limited to the single existing Elastic Beanstalk-managed stack ARN for `shoc-backend-dev`; it cannot create stacks or update any other stack. +Once `UpdateStack` was allowed, CloudFormation returned `S3 error: Access +Denied` while resolving the Elastic Beanstalk-managed template. The caller +therefore receives `s3:GetObject` on the same Beanstalk-only object namespace; +the policy still does not grant `s3:Get*` or access to other bucket names. + The pinned deployment action can return success after Elastic Beanstalk emits a fatal deployment event. The following workflow step therefore verifies that the exact immutable version label is active and healthy before smoke testing. diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts index fab7154..99d64fa 100644 --- a/infra/cdk/deploy-dev-stack.ts +++ b/infra/cdk/deploy-dev-stack.ts @@ -211,7 +211,7 @@ export class DeployDevStack extends cdk.Stack { deployRole.addToPolicy( new iam.PolicyStatement({ effect: iam.Effect.ALLOW, - actions: ['s3:DeleteObject', 's3:GetObjectAcl'], + actions: ['s3:DeleteObject', 's3:GetObject', 's3:GetObjectAcl'], // UpdateEnvironment also checks and removes temporary objects in // AWS-owned Elastic Beanstalk buckets. AWS Support case // 178526484500047 confirmed that the caller's identity policy must