From 5cbe8454abfcc4d0510083b3a096de368dc14a43 Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Fri, 4 Sep 2026 14:09:23 -0600
Subject: [PATCH] fix: authorize channel-project vended log delivery

Add the AWS-documented CloudWatch Logs V2 delivery permissions and the
CloudFront AllowVendedLogDeliveryForResource authorization to the
channel-project site-infrastructure role. The consumer apply that created
distribution E3TJ32HSW2SEZ9 failed only at PutDeliverySource with
AccessDeniedException for cloudfront:AllowVendedLogDeliveryForResource;
the permission set follows the documented S3-destination vended-delivery
policy, scoped to this account's delivery objects and distributions.
---
 aws-github-oidc.tf | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/aws-github-oidc.tf b/aws-github-oidc.tf
index c2c29bd..c793498 100644
--- a/aws-github-oidc.tf
+++ b/aws-github-oidc.tf
@@ -295,6 +295,47 @@ resource "aws_iam_role_policy" "github_actions_channel_project_site_infrastructu
           "cloudfront:ListResponseHeadersPolicies"
         ]
         Resource = "*"
+      },
+      {
+        Sid    = "ManageVendedLogDeliveries"
+        Effect = "Allow"
+        Action = [
+          "logs:CreateDelivery",
+          "logs:DeleteDelivery",
+          "logs:DeleteDeliveryDestination",
+          "logs:DeleteDeliveryDestinationPolicy",
+          "logs:DeleteDeliverySource",
+          "logs:GetDelivery",
+          "logs:GetDeliveryDestination",
+          "logs:GetDeliveryDestinationPolicy",
+          "logs:GetDeliverySource",
+          "logs:PutDeliveryDestination",
+          "logs:PutDeliveryDestinationPolicy",
+          "logs:PutDeliverySource",
+          "logs:UpdateDeliveryConfiguration"
+        ]
+        Resource = [
+          "arn:aws:logs:us-east-1:${data.aws_caller_identity.current.account_id}:delivery:*",
+          "arn:aws:logs:us-east-1:${data.aws_caller_identity.current.account_id}:delivery-source:*",
+          "arn:aws:logs:us-east-1:${data.aws_caller_identity.current.account_id}:delivery-destination:*"
+        ]
+      },
+      {
+        Sid    = "DescribeVendedLogDeliveries"
+        Effect = "Allow"
+        Action = [
+          "logs:DescribeConfigurationTemplates",
+          "logs:DescribeDeliveries",
+          "logs:DescribeDeliveryDestinations",
+          "logs:DescribeDeliverySources"
+        ]
+        Resource = "*"
+      },
+      {
+        Sid      = "AuthorizeSiteVendedLogDelivery"
+        Effect   = "Allow"
+        Action   = ["cloudfront:AllowVendedLogDeliveryForResource"]
+        Resource = ["arn:aws:cloudfront::${data.aws_caller_identity.current.account_id}:distribution/*"]
       }
     ]
   })