fix(iam): authorize channel-project ACM certificate lifecycle

[xnoto]

Summary

• Authorize the github-actions-channel-project-site-infrastructure role to request and manage the us-east-1 ACM viewer-certificate lifecycle required by channel-project.
• Remediate the verified acm:RequestCertificate denial in the merged channel-project main apply.
• Scope certificate lifecycle actions to this AWS account's us-east-1 certificate ARNs; retain the AWS-required wildcard resource only for acm:RequestCertificate.

No linked issue.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass: OpenTofu test and plan succeeded for branch head 9e850faa33dd476c1f44c96c6c6ef452388d0a37.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — the validation workflow committed the terraform-docs README update.
• Reviewed current AWS ACM IAM action/resource documentation: RequestCertificate requires wildcard scope; request tagging requires AddTagsToCertificate; describe, list tags, remove tags, and delete use certificate ARNs.

Impact and rollout

• Producer: this root manages the channel-project OIDC infrastructure role. Consumer: makeitworkcloud/channel-project uses that role in its OpenTofu workflow.
• Verified failure: channel-project main apply run 33942197260 failed before certificate creation because the role lacked acm:RequestCertificate. No CloudFront alias or Cloudflare DNS record changed.
• Verified planned change: one new inline policy on github-actions-channel-project-site-infrastructure; it permits ACM request plus certificate lifecycle actions only in us-east-1 for this AWS account. It does not request a certificate, alter CloudFront, or change DNS itself.
• Follow-up gate: after the policy apply succeeds, the failed channel-project ACM request must be retried through its workflow before validation CNAMEs, certificate issuance, aliases, or DNS cutover can proceed. That retry remains separately confirmation-gated.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• This is an IAM capability addition. Rollback is a reviewed removal of this dedicated inline policy after the certificate lifecycle is no longer owned by channel-project; do not use manual console policy edits.

AI assistance materially produced this change; reviewers should verify the role identity, action set, region/account certificate scope, and cross-repository retry gate.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_acm will be created
  + resource "aws_iam_role_policy" "github_actions_channel_project_site_acm" {
      + id          = (known after apply)
      + name        = "channel-project-site-acm"
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "acm:RequestCertificate",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "RequestSiteViewerCertificate"
                    },
                  + {
                      + Action   = [
                          + "acm:AddTagsToCertificate",
                          + "acm:DeleteCertificate",
                          + "acm:DescribeCertificate",
                          + "acm:ListTagsForCertificate",
                          + "acm:RemoveTagsFromCertificate",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:acm:us-east-1:332355796717:certificate/*"
                      + Sid      = "ManageSiteViewerCertificate"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = "github-actions-channel-project-site-infrastructure"
    }

Plan: 1 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

  # aws_iam_role_policy.github_actions_channel_project_site_acm will be created
  + resource "aws_iam_role_policy" "github_actions_channel_project_site_acm" {
      + id          = (known after apply)
      + name        = "channel-project-site-acm"
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "acm:RequestCertificate",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                      + Sid      = "RequestSiteViewerCertificate"
                    },
                  + {
                      + Action   = [
                          + "acm:AddTagsToCertificate",
                          + "acm:DeleteCertificate",
                          + "acm:DescribeCertificate",
                          + "acm:ListTagsForCertificate",
                          + "acm:RemoveTagsFromCertificate",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:acm:us-east-1:332355796717:certificate/*"
                      + Sid      = "ManageSiteViewerCertificate"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = "github-actions-channel-project-site-infrastructure"
    }

Plan: 1 to add, 0 to change, 0 to destroy.