infra: allow control invoker describe

- grant ec2:DescribeInstances for fleet status
2026-02-03 13:58:11 -08:00 · 2026-02-03 13:58:11 -08:00 · ba96cfbebf
commit ba96cfbebf
parent bda89e4c97
1 changed files with 5 additions and 0 deletions
--- a/infra/opentofu/aws/main.tf
+++ b/infra/opentofu/aws/main.tf
@ -447,6 +447,11 @@ data "aws_iam_policy_document" "control_invoker" {
    actions = ["lambda:InvokeFunction"]
    resources = [aws_lambda_function.control[0].arn]
  }
+
+  statement {
+    actions = ["ec2:DescribeInstances"]
+    resources = ["*"]
+  }
 }

 resource "aws_iam_user_policy" "control_invoker" {