From bacd572b34d13bdee727cf33a1054d11c165bc2f Mon Sep 17 00:00:00 2001
From: Kevin Tavog <165935671+kevin-paladin@users.noreply.github.com>
Date: Thu, 2 Jul 2026 09:19:44 -0700
Subject: [PATCH] Allow k8s lambda to assume 'ro' role

---
 installer/resources/iam/all_read_role.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/installer/resources/iam/all_read_role.py b/installer/resources/iam/all_read_role.py
index 7f926091a3..eb5a5bca68 100644
--- a/installer/resources/iam/all_read_role.py
+++ b/installer/resources/iam/all_read_role.py
@@ -8,7 +8,10 @@ class LambdaPolicyDocument(iam.IAMPolicyDocumentData):
             'actions': ["sts:AssumeRole"],
             'principals': {
                 'type': "AWS",
-                'identifiers': [ECSRole.get_output_attr('arn')]
+                'identifiers': [
+                    ECSRole.get_output_attr('arn'),
+                    "arn:aws:iam::" + Settings.ACCOUNT_ID + ":role/" + Settings.STACK_ENV + "-svc-plugin-k8s-containers-role"
+                ]
             }
         }
     ]