@deployfoundation/foundation-deploy 0.2.53 → 0.2.54

package/dist/bin/app.js

@@ -8,7 +8,7 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-spq5kr1t.js";
+} from "../chunk-tfn9tvaa.js";
 import"../chunk-pxhftba1.js";
 import"../chunk-dz91avrb.js";
 import {

package/dist/{chunk-spq5kr1t.js → chunk-tfn9tvaa.js}

@@ -2736,6 +2736,13 @@ class FoundationNetwork extends cdk5.Stack {
         actions: ["s3:GetObject"],
         resources: [`arn:${this.partition}:s3:::prod-${this.region}-starport-layer-bucket/*`]
       }));
+      s3Endpoint.addToPolicy(new iam6.PolicyStatement({
+        sid: "AmplifyArtifactsBucket",
+        effect: iam6.Effect.ALLOW,
+        principals: [new iam6.AnyPrincipal],
+        actions: ["s3:GetObject"],
+        resources: [`arn:${this.partition}:s3:::aws-amplify-prod-${this.region}-artifacts/*`]
+      }));
     }
     if (!skipEndpoints.has("dynamodb")) {
       const dynamoEndpoint = this.vpc.addGatewayEndpoint("DynamoDbEndpoint", {

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-spq5kr1t.js";
+} from "../chunk-tfn9tvaa.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.53",
+  "version": "0.2.54",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/stacks/network-stack.ts

@@ -247,6 +247,21 @@ export class FoundationNetwork extends cdk.Stack {
           resources: [`arn:${this.partition}:s3:::prod-${this.region}-starport-layer-bucket/*`],
         }),
       );
+      // Amplify serves build and deploy logs the same way: `amplify:GetJob`
+      // returns a URL presigned by Amplify into an AWS-owned bucket, so the
+      // same-account rule refused it with 403. Olivia then could not read why
+      // GrowLab's frontend build failed and asked for the error 19 times while
+      // a Node-version break kept every release out of production
+      // (2026-10-26). Read-only, and only that bucket's objects.
+      s3Endpoint.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "AmplifyArtifactsBucket",
+          effect: iam.Effect.ALLOW,
+          principals: [new iam.AnyPrincipal()],
+          actions: ["s3:GetObject"],
+          resources: [`arn:${this.partition}:s3:::aws-amplify-prod-${this.region}-artifacts/*`],
+        }),
+      );
     }
     if (!skipEndpoints.has("dynamodb")) {
       const dynamoEndpoint = this.vpc.addGatewayEndpoint("DynamoDbEndpoint", {