From 29ab4385bec2b57f084e74c18578c7770af51a64 Mon Sep 17 00:00:00 2001
From: Jerome Van Der Linden <jvdl@amazon.com>
Date: Thu, 15 Oct 2026 19:32:49 +0200
Subject: [PATCH] fix(terraform): grant intents Lambda
 dynamodb:ConditionCheckItem

Gate answers write a TransactWriteItems that fences run and stage
ownership with ConditionCheck entries (humanTaskAnswerOwnershipChecks,
added in 663962ee via #466). DynamoDB authorizes each ConditionCheck as
dynamodb:ConditionCheckItem, which the intents role never had, so every
answer to an engine gate failed with AccessDeniedException (HTTP 500).
---
 terraform/modules/api/lambda/main.tf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/terraform/modules/api/lambda/main.tf b/terraform/modules/api/lambda/main.tf
index 005db9e52..920c21325 100644
--- a/terraform/modules/api/lambda/main.tf
+++ b/terraform/modules/api/lambda/main.tf
@@ -2810,6 +2810,8 @@ resource "aws_iam_role_policy" "intents" {
       {
         # v2 process table: read/write execution state + GSI1 list. Delete /
         # BatchWrite drain the whole EXEC#<id> partition on intent delete.
+        # ConditionCheckItem: gate answers fence run/stage ownership with
+        # ConditionCheck entries inside TransactWriteItems.
         Effect = "Allow"
         Action = [
           "dynamodb:GetItem",
@@ -2820,6 +2822,7 @@ resource "aws_iam_role_policy" "intents" {
           "dynamodb:DeleteItem",
           "dynamodb:BatchWriteItem",
           "dynamodb:TransactWriteItems",
+          "dynamodb:ConditionCheckItem",
         ]
         Resource = [
           var.v2_executions_table_arn,