From 0012e90655e08fa28d23c86161a56fe2c9074009 Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Fri, 4 Sep 2026 13:18:58 -0600
Subject: [PATCH] fix: use canonical channel site S3 IAM actions

---
 aws-github-oidc.tf | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/aws-github-oidc.tf b/aws-github-oidc.tf
index 941fe4d..c2c29bd 100644
--- a/aws-github-oidc.tf
+++ b/aws-github-oidc.tf
@@ -225,31 +225,31 @@ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructu
         Action = [
           "s3:DeleteBucket",
           "s3:DeleteBucketPolicy",
-          "s3:GetBucketAccelerateConfiguration",
+          "s3:GetAccelerateConfiguration",
           "s3:GetBucketAcl",
-          "s3:GetBucketCors",
-          "s3:GetBucketEncryption",
-          "s3:GetBucketLifecycleConfiguration",
+          "s3:GetBucketCORS",
           "s3:GetBucketLocation",
           "s3:GetBucketLogging",
           "s3:GetBucketObjectLockConfiguration",
           "s3:GetBucketOwnershipControls",
           "s3:GetBucketPolicy",
           "s3:GetBucketPublicAccessBlock",
-          "s3:GetBucketReplication",
           "s3:GetBucketRequestPayment",
           "s3:GetBucketTagging",
           "s3:GetBucketVersioning",
           "s3:GetBucketWebsite",
+          "s3:GetEncryptionConfiguration",
+          "s3:GetLifecycleConfiguration",
+          "s3:GetReplicationConfiguration",
           "s3:ListBucket",
           "s3:PutBucketAcl",
-          "s3:PutBucketEncryption",
-          "s3:PutBucketLifecycleConfiguration",
           "s3:PutBucketOwnershipControls",
           "s3:PutBucketPolicy",
           "s3:PutBucketPublicAccessBlock",
           "s3:PutBucketTagging",
-          "s3:PutBucketVersioning"
+          "s3:PutBucketVersioning",
+          "s3:PutEncryptionConfiguration",
+          "s3:PutLifecycleConfiguration"
         ]
         Resource = [
           "arn:aws:s3:::${local.channel_project_site_bucket}",