fix: allow channel-project S3 bucket refresh

[xnoto]

Summary

Add s3:ListBucket for the two project-owned static-site buckets to the existing github-actions-channel-project-site-infrastructure role policy.

The channel-project OpenTofu plan refreshes both bucket addresses. Although the buckets exist and the role already has their configuration read/write actions, S3 HeadBucket requires s3:ListBucket; AWS returns a generic failure when that permission is absent. The provider therefore reports both state-tracked buckets as deleted and plans duplicate creates. This PR grants only the missing bucket-level discovery action on the two canonical bucket ARNs.

Fixes # N/A — recovery prerequisite for channel-project PR #15.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files are affected.

No local OpenTofu, state, import, plan, or apply operation was run or claimed. The latest channel-project plan passed validation but refreshed the two state-tracked buckets as externally deleted and planned replacement. A read-only AWS inspection in account 332355796717 confirmed both buckets exist in us-west-2 with public access blocked, bucket-owner enforcement, and AES256 default encryption. AWS documents that HeadBucket requires s3:ListBucket.

Impact and rollout

Producer: tfroot-aws is the canonical owner of this OIDC role and inline policy. Consumer: channel-project/tofu/aws uses the role through the reusable OpenTofu workflow.

After merge and environment-gated main apply, rerun the channel-project plan. It must refresh the existing buckets successfully and no longer propose their creation before any recovery PR is merged or any main apply is allowed. This change neither creates/deletes buckets nor deploys site assets, CloudFront, ACM aliases, or DNS changes on its own.

Rollback before apply is closing/reverting this PR. If applied, reverting removes only the added discovery permission; it must not be reverted while the channel-project root still needs to refresh those buckets.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

AI agent materially produced this change; reviewers should verify the two bucket ARNs are the intended project-owned resources and that s3:ListBucket is sufficient for the AWS provider refresh path.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_infrastructure will be updated in-place
  ~ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructure" {
        id     = "github-actions-channel-project-site-infrastructure:channel-project-site-infrastructure"
        name   = "channel-project-site-infrastructure"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (3 unchanged elements hidden)
                    {
                        Action   = [
                            "s3:CreateBucket",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "CreateSiteBuckets"
                    },
                  ~ {
                      ~ Action   = [
                            # (10 unchanged elements hidden)
                            "s3:GetBucketVersioning",
                          + "s3:ListBucket",
                            "s3:PutBucketAcl",
                            # (7 unchanged elements hidden)
                        ]
                        # (3 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "cloudfront:CreateOriginAccessControl",
                            "cloudfront:DeleteOriginAccessControl",
                            "cloudfront:GetOriginAccessControl",
                            "cloudfront:GetOriginAccessControlConfig",
                            "cloudfront:ListOriginAccessControls",
                            "cloudfront:UpdateOriginAccessControl",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "ManageSiteOriginAccessControl"
                    },
                    # (2 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_infrastructure will be updated in-place
  ~ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructure" {
        id     = "github-actions-channel-project-site-infrastructure:channel-project-site-infrastructure"
        name   = "channel-project-site-infrastructure"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (3 unchanged elements hidden)
                    {
                        Action   = [
                            "s3:CreateBucket",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "CreateSiteBuckets"
                    },
                  ~ {
                      ~ Action   = [
                            # (10 unchanged elements hidden)
                            "s3:GetBucketVersioning",
                          + "s3:ListBucket",
                            "s3:PutBucketAcl",
                            # (7 unchanged elements hidden)
                        ]
                        # (3 unchanged attributes hidden)
                    },
                    {
                        Action   = [
                            "cloudfront:CreateOriginAccessControl",
                            "cloudfront:DeleteOriginAccessControl",
                            "cloudfront:GetOriginAccessControl",
                            "cloudfront:GetOriginAccessControlConfig",
                            "cloudfront:ListOriginAccessControls",
                            "cloudfront:UpdateOriginAccessControl",
                        ]
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "ManageSiteOriginAccessControl"
                    },
                    # (2 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.