From de409f8c8d0c6d9326c5b45b139a9beda9b28e38 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 13:37:16 -0400
Subject: [PATCH] fix(iam): scope staging githubdeploy S3 object access to the
 EB bucket

---
 terraform/live/modules/environment-owned/main.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/terraform/live/modules/environment-owned/main.tf b/terraform/live/modules/environment-owned/main.tf
index 5e612d4..09b1f88 100644
--- a/terraform/live/modules/environment-owned/main.tf
+++ b/terraform/live/modules/environment-owned/main.tf
@@ -303,8 +303,8 @@ data "aws_iam_policy_document" "deploy" {
         "s3:DeleteObject",
       ]
       resources = [
-        "arn:aws:s3:::${local.eb_bucket_name}/${var.eb_application_name}/*",
-        "arn:aws:s3:::${local.eb_bucket_name}/resources/*",
+        "arn:aws:s3:::${local.eb_bucket_name}",
+        "arn:aws:s3:::${local.eb_bucket_name}/*",
       ]
     }
   }