[EPAC-2102]: add missing Lambda IAM permissions for Terraform lifecycle management#628
Merged
riddim-developer-bot[bot] merged 1 commit intoMay 26, 2026
Conversation
…le management The staging (and production) CI IAM roles were missing Lambda actions that the Terraform AWS provider needs to manage the full resource lifecycle: ListVersionsByFunction for state refresh, CreateFunction and DeleteFunction for new/removed services, and tag management actions.
riddim-developer-bot
Bot
added
the
autonomous
riddim-developer-bot
Bot
added
the
autonomous
riddim-developer-bot
Bot
deleted the
symphony/epac-2102-ci-backend-staging-deploy-failing-on-main
branch
May 26, 2026 01:58
riddim-developer-bot Bot
added a commit
that referenced
this pull request
May 26, 2026
## Why Infrastructure Validation failed on PR #628 because the staging Terraform plan comment step hit `403 Resource not accessible by integration` while trying to create a sticky PR comment. That masked the Terraform plan failure path and made the comment publisher itself a CI blocker. ## What changed - Grant the workflow `pull-requests: write` so PR comment writes have the permission GitHub reports as accepted for the comments endpoint. - Wrap sticky Terraform plan comment publishing in a warning-only `try`/`catch`, so Terraform init/plan outcomes continue to govern the job result. ## Trade-offs not taken I did not remove the sticky comment step; it is still useful review context when GitHub accepts the write. The fallback only prevents optional comment publishing from becoming the failing gate. ## Test plan - `actionlint .github/workflows/infra-validate.yml` - Pre-commit hook: `actionlint` on staged workflow file - `git diff --check` Skipped checks: iOS build/test and Terraform validate were not run because this PR only changes GitHub Actions workflow control flow. Reviewer-Boundary: review-only Resolves EPAC-2103 _Issue estimate was not set in Linear; treated as the standard 8-complexity tier for implementation._ Co-authored-by: riddim-developer-bot <developer-bot@riddimsoftware.com> Co-authored-by: Sunny Purewal <sunny@riddimsoftware.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
lambda:ListVersionsByFunction,lambda:CreateFunction,lambda:DeleteFunction,lambda:GetPolicy,lambda:ListTags,lambda:TagResource, andlambda:UntagResourceto both the staging and production CI IAM role policiesRoot cause
PR #627 (EPAC-2101) re-added
terraform applyfor the staging workspace to the backend staging deploy workflow. The Terraform provider callslambda:ListVersionsByFunctionduring the state refresh phase, but theManageStagingLambdaIAM policy only included the subset of Lambda actions needed for direct CLI deploys (update-function-code, get-function, etc.) — not the broader set Terraform needs.Failed run: https://github.com/RiddimSoftware/epac/actions/runs/26427674950
Error:
User: arn:aws:sts::227530433709:assumed-role/GitHubActions-epac-backend-staging/GitHubActions is not authorized to perform: lambda:ListVersionsByFunction on resource: arn:aws:lambda:us-east-1:227530433709:function:epac-health-stagingPost-merge action required
The IAM policy is managed by the core Terraform workspace (
infra/terraform/core/), which is applied separately from the staging workspace. After this PR merges, the core workspace must be applied before the next staging deploy will succeed:cd infra/terraform/core terraform init terraform applyVerification
terraform validatepasses for the core workspaceReviewer-Boundary: review-only
Resolves EPAC-2102
Issue estimate was not set in Linear.