fix(cdk): allow EB extension verification

infra/cdk/README.md

@@ -62,13 +62,21 @@ The role grants only:
   the matching version-ACL write. The grant does not cover another
   environment, another application, source bundles, object content versions,
   non-version ACL mutation, tags, or retention.
-- `s3:PutObject` on only
+- `s3:PutObject` on only the two embedded-extension prefixes
-  `elasticbeanstalk-us-east-1-396287094661/resources/_runtime/_embedded_extensions/shoc-backend/*`.
+  `elasticbeanstalk-us-east-1-396287094661/resources/_runtime/_embedded_extensions/shoc-backend/*`
+  and
+  `elasticbeanstalk-us-east-1-396287094661/resources/environments/e-hehnrqjjrt/_runtime/_embedded_extensions/shoc-backend/*`.
   After the runtime bundle copy and version-ACL operations succeeded, attempt 8
   of run `30448885838` showed Elastic Beanstalk materializing the application's
-  embedded-extension manifest at this application-specific prefix. CloudTrail
+  embedded-extension manifest at the application-specific shared prefix.
-  recorded the exact denied action and object ARN. The grant does not include
+  Attempt 9 then showed the matching write into the exact dev-environment
-  reads, deletes, ACL mutation, another application, or another bucket.
+  prefix. CloudTrail recorded both denied actions and object ARNs. The grant
+  does not include reads, deletes, ACL mutation, another application,
+  another environment, or another bucket.
+- `s3:GetObject` on only the environment-specific embedded-extension prefix
+  above. Attempt 10 showed that Elastic Beanstalk verifies the materialized
+  environment copy with `HeadObject`, which S3 authorizes through
+  `s3:GetObject`. The shared embedded-extension prefix remains write-only.
 - `s3:GetObjectAcl` on objects under the service-wide
   `arn:aws:s3:::elasticbeanstalk-*/*` namespace. AWS Support case
   `178526484500047` confirmed that `UpdateEnvironment` uses the initiating

infra/cdk/deploy-dev-stack.ts

@@ -24,6 +24,9 @@ export class DeployDevStack extends cdk.Stack {
     const embeddedExtensionArn =
       `${bucketArn}/resources/_runtime/_embedded_extensions/` +
       `${APPLICATION_NAME}/*`;
+    const environmentEmbeddedExtensionArn =
+      `${bucketArn}/resources/environments/${ENVIRONMENT_ID}` +
+      `/_runtime/_embedded_extensions/${APPLICATION_NAME}/*`;
     const oidcProviderArn = `arn:aws:iam::${ACCOUNT_ID}:oidc-provider/token.actions.githubusercontent.com`;
 
     const deployRole = new iam.Role(this, 'GithubDeployRole', {
@@ -175,8 +178,17 @@ export class DeployDevStack extends cdk.Stack {
         effect: iam.Effect.ALLOW,
         actions: ['s3:PutObject'],
         // UpdateEnvironment materializes the application's embedded-extension
-        // manifest under this application-specific runtime prefix.
+        // manifest under the shared and environment-specific runtime prefixes.
-        resources: [embeddedExtensionArn],
+        resources: [embeddedExtensionArn, environmentEmbeddedExtensionArn],
+      }),
+    );
+
+    deployRole.addToPolicy(
+      new iam.PolicyStatement({
+        effect: iam.Effect.ALLOW,
+        actions: ['s3:GetObject'],
+        // Elastic Beanstalk verifies the environment copy with HeadObject.
+        resources: [environmentEmbeddedExtensionArn],
       }),
     );