From 216580af41b565286f4104fdab6ecf1537ecf929 Mon Sep 17 00:00:00 2001
From: Hashversion <110537156+Hashversion@users.noreply.github.com>
Date: Sun, 17 May 2026 00:20:03 +0530
Subject: [PATCH 1/2] fix: add iam permission for oidc provider thumbprint
 update

---
 infra/aws/main/iam.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/infra/aws/main/iam.tf b/infra/aws/main/iam.tf
index 417526e..6147192 100644
--- a/infra/aws/main/iam.tf
+++ b/infra/aws/main/iam.tf
@@ -39,6 +39,7 @@ data "aws_iam_policy_document" "github_actions_infrastructure" {
       "iam:CreateOpenIDConnectProvider",
       "iam:GetOpenIDConnectProvider",
       "iam:UpdateOpenIDConnectProvider",
+      "iam:UpdateOpenIDConnectProviderThumbprint",
       "iam:DeleteOpenIDConnectProvider",
       "iam:ListOpenIDConnectProviders",
       "iam:TagOpenIDConnectProvider",

From fbc74380b14c79a4230f18d9a79d0a4be59db1e8 Mon Sep 17 00:00:00 2001
From: Hashversion <110537156+Hashversion@users.noreply.github.com>
Date: Sun, 17 May 2026 00:27:08 +0530
Subject: [PATCH 2/2] fix: add iam permission to create policy versions

---
 infra/aws/main/iam.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/infra/aws/main/iam.tf b/infra/aws/main/iam.tf
index 6147192..6e76923 100644
--- a/infra/aws/main/iam.tf
+++ b/infra/aws/main/iam.tf
@@ -56,6 +56,7 @@ data "aws_iam_policy_document" "github_actions_infrastructure" {
     effect = "Allow"
     actions = [
       "iam:CreatePolicy",
+      "iam:CreatePolicyVersion",
       "iam:GetPolicy",
       "iam:GetPolicyVersion",
       "iam:ListPolicyVersions",