From 5f4c9d6f1e5af4154f26e5b5d04110226536f68b Mon Sep 17 00:00:00 2001
From: Pete Cornish <outofcoffee@gmail.com>
Date: Thu, 3 Sep 2026 17:21:59 +0100
Subject: [PATCH] fix(remote): grant the deploy role
 secretsmanager:PutSecretValue

---
 remote/lib/llm-stack.ts   | 9 ++++++++-
 remote/test/stack.test.ts | 1 +
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/remote/lib/llm-stack.ts b/remote/lib/llm-stack.ts
index 585e3d7a..9ed40d7f 100644
--- a/remote/lib/llm-stack.ts
+++ b/remote/lib/llm-stack.ts
@@ -531,9 +531,16 @@ export class LlmStack extends cdk.Stack {
       }),
     );
     seedLaunchStatements().forEach((s) => deployFn.addToRolePolicy(s));
+    // CreateSecret/DescribeSecret mint the environment's key on first deploy;
+    // PutSecretValue rotates it when a deploy supplies a key, which
+    // invalidates the old value. All scoped to the per-environment secrets.
     deployFn.addToRolePolicy(
       new iam.PolicyStatement({
-        actions: ['secretsmanager:CreateSecret', 'secretsmanager:DescribeSecret'],
+        actions: [
+          'secretsmanager:CreateSecret',
+          'secretsmanager:DescribeSecret',
+          'secretsmanager:PutSecretValue',
+        ],
         resources: [envSecretArn],
       }),
     );
diff --git a/remote/test/stack.test.ts b/remote/test/stack.test.ts
index 1c312c73..81e39a9c 100644
--- a/remote/test/stack.test.ts
+++ b/remote/test/stack.test.ts
@@ -172,6 +172,7 @@ describe('LlmStack (control plane)', () => {
       'ec2:AuthorizeSecurityGroupIngress',
       'ec2:RevokeSecurityGroupIngress',
       'secretsmanager:CreateSecret',
+      'secretsmanager:PutSecretValue',
     ]) {
       expect(actions).toContain(action);
     }