From f31334bd7a8d9ff80c2ec63ae5f91c33d64257c8 Mon Sep 17 00:00:00 2001
From: Matthew Meszaros <meszmatew@gmail.com>
Date: Thu, 22 Oct 2026 12:14:15 +0200
Subject: [PATCH] feat: allow the AWS deployment role to pass the backend and
 consumer task roles to ECS

---
 deploy/terraform/aws/runtime/ci.tf | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/deploy/terraform/aws/runtime/ci.tf b/deploy/terraform/aws/runtime/ci.tf
index 6ba811593..519cda795 100644
--- a/deploy/terraform/aws/runtime/ci.tf
+++ b/deploy/terraform/aws/runtime/ci.tf
@@ -67,8 +67,10 @@ data "aws_iam_policy_document" "github_deploy" {
     }
   }
   statement {
-    actions   = ["iam:PassRole"]
-    resources = [aws_iam_role.migration_execution.arn]
+    actions = ["iam:PassRole"]
+    resources = concat([aws_iam_role.migration_execution.arn], flatten([
+      for name in ["backend", "consumer"] : [aws_iam_role.execution[name].arn, aws_iam_role.application[name].arn]
+    ]))
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"