From b8db4a7e61e838c239752a8d506feadeea2a9ece Mon Sep 17 00:00:00 2001 From: brandizzi Date: Wed, 29 Jul 2026 11:02:30 -0300 Subject: [PATCH] fix(cdk): allow EB bucket policy read --- infra/cdk/README.md | 3 ++- infra/cdk/deploy-dev-stack.ts | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/infra/cdk/README.md b/infra/cdk/README.md index c790ad8..9485c85 100644 --- a/infra/cdk/README.md +++ b/infra/cdk/README.md @@ -42,7 +42,8 @@ The role grants only: - `elasticbeanstalk:UpdateEnvironment` on environment `shoc-backend-dev` only. - `s3:ListBucket` and `s3:GetBucketLocation` on `elasticbeanstalk-us-east-1-396287094661` (the official action's - ownership-safe bucket checks), plus `s3:CreateBucket` and + ownership-safe bucket checks), `s3:GetBucketPolicy` for the policy inspection + observed in attempt 11 of run `30448885838`, plus `s3:CreateBucket` and `s3:PutBucketOwnershipControls` on the same bucket-level ARN. Under the `shoc-backend/` object prefix only: `s3:PutObject`, `s3:GetObject`, and `s3:GetObjectVersion`, which the pinned diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts index e0f3853..d501786 100644 --- a/infra/cdk/deploy-dev-stack.ts +++ b/infra/cdk/deploy-dev-stack.ts @@ -143,6 +143,7 @@ export class DeployDevStack extends cdk.Stack { 's3:CreateBucket', 's3:PutBucketOwnershipControls', 's3:GetBucketLocation', + 's3:GetBucketPolicy', ], resources: [bucketArn], }),