From afa16bd570a21698be4fc7fcb9b50c0b6b41e878 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 13:22:06 -0400
Subject: [PATCH] fix(iam): grant staging githubdeploy named S3 reads on EB
 resources prefix

---
 terraform/live/modules/environment-owned/main.tf | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/terraform/live/modules/environment-owned/main.tf b/terraform/live/modules/environment-owned/main.tf
index 1967054..2ad1453 100644
--- a/terraform/live/modules/environment-owned/main.tf
+++ b/terraform/live/modules/environment-owned/main.tf
@@ -295,12 +295,15 @@ data "aws_iam_policy_document" "deploy" {
       effect = "Allow"
       actions = [
         "s3:PutObject",
+        "s3:PutObjectAcl",
         "s3:GetObject",
         "s3:GetObjectAcl",
+        "s3:GetObjectVersion",
+        "s3:GetObjectVersionAcl",
       ]
       resources = [
         "arn:aws:s3:::${local.eb_bucket_name}/${var.eb_application_name}/*",
-        "arn:aws:s3:::${local.eb_bucket_name}/resources/_runtime/_embedded_extensions/${var.eb_application_name}/*",
+        "arn:aws:s3:::${local.eb_bucket_name}/resources/*",
       ]
     }
   }