From f4d9a4a1b85dc95ccb941ff0ba2aad77db281f43 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 18 Sep 2026 14:00:13 -0400
Subject: [PATCH] fix(iam): allow staging githubdeploy GetBucketPolicy on the
 EB bucket

---
 terraform/live/modules/environment-owned/main.tf | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/terraform/live/modules/environment-owned/main.tf b/terraform/live/modules/environment-owned/main.tf
index 9303f8b..c4ef076 100644
--- a/terraform/live/modules/environment-owned/main.tf
+++ b/terraform/live/modules/environment-owned/main.tf
@@ -313,8 +313,15 @@ data "aws_iam_policy_document" "deploy" {
   dynamic "statement" {
     for_each = local.use_legacy_s3_policy ? [] : [1]
     content {
-      effect    = "Allow"
-      actions   = ["s3:GetBucketLocation", "s3:ListBucket"]
+      effect = "Allow"
+      actions = [
+        "s3:GetBucketLocation",
+        "s3:ListBucket",
+        "s3:GetBucketPolicy",
+        "s3:GetBucketAcl",
+        "s3:GetBucketVersioning",
+        "s3:GetBucketOwnershipControls",
+      ]
       resources = ["arn:aws:s3:::${local.eb_bucket_name}"]
     }
   }