From bda89e4c97f8558bd6dade296cfd5a394b6b85b6 Mon Sep 17 00:00:00 2001
From: Josh Palmer <joshp123@users.noreply.github.com>
Date: Tue, 3 Feb 2026 13:44:10 -0800
Subject: [PATCH] infra: allow instance self-bootstrap

- grant instance role read age-secrets
- allow PutObject to bootstrap prefix
---
 infra/opentofu/aws/main.tf | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/infra/opentofu/aws/main.tf b/infra/opentofu/aws/main.tf
index 1127e33..eadad2e 100644
--- a/infra/opentofu/aws/main.tf
+++ b/infra/opentofu/aws/main.tf
@@ -190,6 +190,18 @@ data "aws_iam_policy_document" "instance_bootstrap" {
       "s3:GetObject",
       "s3:GetObjectAttributes"
     ]
+    resources = [
+      "${aws_s3_bucket.image_bucket.arn}/bootstrap/*",
+      "${aws_s3_bucket.image_bucket.arn}/age-secrets/*"
+    ]
+  }
+
+  statement {
+    actions = [
+      "s3:PutObject",
+      "s3:AbortMultipartUpload",
+      "s3:ListMultipartUploadParts"
+    ]
     resources = [
       "${aws_s3_bucket.image_bucket.arn}/bootstrap/*"
     ]
@@ -204,7 +216,7 @@ data "aws_iam_policy_document" "instance_bootstrap" {
     condition {
       test     = "StringLike"
       variable = "s3:prefix"
-      values   = ["bootstrap/*"]
+      values   = ["bootstrap/*", "age-secrets/*"]
     }
   }
 }