From 57fba0c87f0d2af1c595fe288bd33ce2d44d1362 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 16 Sep 2026 17:44:29 -0400
Subject: [PATCH] fix(infra): allow scoped apply to create the EC2 recover
 alarm

PutMetricAlarm with the automate recover action needs RecoverInstances plus CreateServiceLinkedRole for AWSServiceRoleForCloudWatchEvents, which does not exist in seahaven-prod yet.
---
 terraform/hcp_iam.tf | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index d165f89..322cc6a 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -392,6 +392,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "ec2:DescribeImages",
       "ec2:DescribeInstanceAttribute",
       "ec2:DescribeInstanceCreditSpecifications",
+      "ec2:DescribeInstanceRecoveryAttribute",
       "ec2:DescribeInstanceStatus",
       "ec2:DescribeInstanceTypes",
       "ec2:DescribeInstances",
@@ -405,6 +406,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "ec2:ModifyVolume",
       "ec2:MonitorInstances",
       "ec2:RebootInstances",
+      "ec2:RecoverInstances",
       "ec2:ReplaceIamInstanceProfileAssociation",
       "ec2:RunInstances",
       "ec2:StartInstances",
@@ -414,6 +416,22 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
     ]
     resources = ["*"]
   }
+
+  statement {
+    sid    = "CloudWatchEc2RecoverServiceLinkedRole"
+    effect = "Allow"
+    actions = [
+      "iam:CreateServiceLinkedRole",
+    ]
+    resources = [
+      "arn:aws:iam::${local.account_id}:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents",
+    ]
+    condition {
+      test     = "StringEquals"
+      variable = "iam:AWSServiceName"
+      values   = ["events.amazonaws.com"]
+    }
+  }
 }
 
 data "aws_iam_policy_document" "hcptf_plan_refresh" {
@@ -489,6 +507,7 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
       "ec2:DescribeImages",
       "ec2:DescribeInstanceAttribute",
       "ec2:DescribeInstanceCreditSpecifications",
+      "ec2:DescribeInstanceRecoveryAttribute",
       "ec2:DescribeInstanceStatus",
       "ec2:DescribeInstanceTypes",
       "ec2:DescribeInstances",