From a77cfcd66bdb907438649157e1ef54ebe7815d1d Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Fri, 4 Sep 2026 21:41:51 -0600 Subject: [PATCH 1/2] fix(iam): authorize channel-project ACM certificate lifecycle --- aws-channel-project-site-acm.tf | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 aws-channel-project-site-acm.tf diff --git a/aws-channel-project-site-acm.tf b/aws-channel-project-site-acm.tf new file mode 100644 index 0000000..70463a9 --- /dev/null +++ b/aws-channel-project-site-acm.tf @@ -0,0 +1,31 @@ +# This scoped role policy is separate from S3/CloudFront distribution management. +# It grants only the ACM lifecycle actions required by channel-project's +# us-east-1 CloudFront viewer certificate. +resource "aws_iam_role_policy" "github_actions_channel_project_site_acm" { + name = "channel-project-site-acm" + role = aws_iam_role.github_actions_channel_project_site_infrastructure.id + + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Sid = "RequestSiteViewerCertificate" + Effect = "Allow" + Action = ["acm:RequestCertificate"] + Resource = "*" + }, + { + Sid = "ManageSiteViewerCertificate" + Effect = "Allow" + Action = [ + "acm:AddTagsToCertificate", + "acm:DeleteCertificate", + "acm:DescribeCertificate", + "acm:ListTagsForCertificate", + "acm:RemoveTagsFromCertificate" + ] + Resource = "arn:aws:acm:us-east-1:${data.aws_caller_identity.current.account_id}:certificate/*" + } + ] + }) +} From 9e850faa33dd476c1f44c96c6c6ef452388d0a37 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 03:43:52 +0000 Subject: [PATCH 2/2] chore: apply pre-commit fixes --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 6373f71..ea54471 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,7 @@ No modules. | [aws_iam_role.opencode_mcp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy.bedrock_batch_invoke](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.bedrock_batch_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | +| [aws_iam_role_policy.github_actions_channel_project_site_acm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.github_actions_channel_project_site_deploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.github_actions_channel_project_site_infrastructure](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy.github_actions_channel_project_site_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |