From d9b5fc952c9a793bb8ab3754455fecbc1030d5d0 Mon Sep 17 00:00:00 2001
From: Paige Williams <pwilliams@ecotrust.org>
Date: Tue, 7 Jul 2026 16:17:25 -0700
Subject: [PATCH 1/2] add role policy attachement

add check for no ec2 instance id
---
 .github/workflows/deploy-ec2-production.yaml | 6 ++++++
 infra/iam.tf                                 | 5 +++++
 2 files changed, 11 insertions(+)

diff --git a/.github/workflows/deploy-ec2-production.yaml b/.github/workflows/deploy-ec2-production.yaml
index 2ffa515..50505e5 100644
--- a/.github/workflows/deploy-ec2-production.yaml
+++ b/.github/workflows/deploy-ec2-production.yaml
@@ -23,6 +23,12 @@ jobs:
                             "Name=instance-state-name,Values=running" \
                     --query "Reservations[0].Instances[0].InstanceId" \
                     --output text)
+                    
+                if [ -z "$INSTANCE_ID" ] || [ "$INSTANCE_ID" = "None" ]; then
+                    echo "::error::No running EC2 instance found for tag Name=${{ secrets.PROD_EC2_INSTANCE_NAME }}"
+                    exit 1
+                fi
+
                 echo "instance_id=$INSTANCE_ID" >> $GITHUB_OUTPUT
             - name: Deploy to EC2 via SSM
               id: ssm-deploy
diff --git a/infra/iam.tf b/infra/iam.tf
index d146d7d..37dedcd 100644
--- a/infra/iam.tf
+++ b/infra/iam.tf
@@ -39,6 +39,11 @@ resource "aws_iam_role_policy" "oh4s_s3_read" {
   })
 }
 
+resource "aws_iam_role_policy_attachment" "ssm_core" {
+  role       = aws_iam_role.oh4s_ec2.name
+  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+}
+
 resource "aws_iam_instance_profile" "oh4s" {
   name = "oh4s-ec2-profile"
   role = aws_iam_role.oh4s_ec2.name

From 7bdcb0109413390df73d9f34c1fa938e0d95cdfd Mon Sep 17 00:00:00 2001
From: Paige Williams <pwilliams@ecotrust.org>
Date: Tue, 7 Jul 2026 16:26:48 -0700
Subject: [PATCH 2/2] use APP_ROOT AND DOCKER_DIR vars

---
 .github/workflows/deploy-ec2-production.yaml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/deploy-ec2-production.yaml b/.github/workflows/deploy-ec2-production.yaml
index 50505e5..888ed87 100644
--- a/.github/workflows/deploy-ec2-production.yaml
+++ b/.github/workflows/deploy-ec2-production.yaml
@@ -37,12 +37,14 @@ jobs:
                     --instance-ids "${{ steps.get-instance.outputs.instance_id }}" \
                     --document-name "AWS-RunShellScript" \
                     --parameters 'commands=[
-                    "echo ${{ secrets.GHCR_TOKEN }} | docker login ghcr.io --username ${{ secrets.GHCR_USERNAME }} --password-stdin",
-                    "cd /OH4S_Proteins/OH4S_Proteins && git pull origin main",
-                    "docker pull ${{ secrets.GHCR_IMAGE_URI }}:latest",
-                    "cd docker",
-                    "docker compose --env-file .env.prod -f docker-compose.prod.yaml down",
-                    "docker compose --env-file .env.prod -f docker-compose.prod.yaml up -d --pull always --force-recreate",
+                        "APP_ROOT=/home/ubuntu/OH4S_Proteins/OH4S_Proteins",
+                        "DOCKER_DIR=$APP_ROOT/docker",
+                        "echo ${{ secrets.GHCR_TOKEN }} | docker login ghcr.io --username ${{ secrets.GHCR_USERNAME }} --password-stdin",
+                        "cd $APP_ROOT && git pull origin main",
+                        "cd $DOCKER_DIR",
+                        "docker pull ${{ secrets.GHCR_IMAGE_URI }}:latest",
+                        "docker compose --env-file .env.prod -f docker-compose.prod.yaml down",
+                        "docker compose --env-file .env.prod -f docker-compose.prod.yaml up -d --pull always --force-recreate",
                     "sleep 5",
                     "docker ps --filter name=oh4s_web --format \"{{.Status}}\"",
                     "docker image prune -f"