From 7b89eadfea4ac5fa2f444332c352e1a8afa45812 Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Fri, 4 Sep 2026 23:15:01 -0600
Subject: [PATCH] fix(aws): order web public access before policy

---
 aws-s3.tf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/aws-s3.tf b/aws-s3.tf
index f119fa6..505bdc0 100644
--- a/aws-s3.tf
+++ b/aws-s3.tf
@@ -117,6 +117,9 @@ resource "aws_s3_bucket_public_access_block" "web" {
 resource "aws_s3_bucket_policy" "web" {
   for_each = aws_s3_bucket.web
 
+  # S3 rejects a public bucket policy until this per-bucket setting is applied.
+  depends_on = [aws_s3_bucket_public_access_block.web]
+
   bucket = each.value.bucket
 
   policy = jsonencode({