Fix deploy_dev failure by granting missing Terraform deploy-role permissions

[Copilot]

Summary

• deploy_dev failed during terraform apply because the GitHub Actions deploy role lacked permissions required by newly managed Terraform resources (aws_default_vpc in ElastiCache networking and aws_scheduler_schedule_group for campaigns).
• IAM policy updates (deploy role):
  • EC2 networking access: added VPC/subnet/security-group read/manage actions needed by elasticache.tf default VPC + SG resources.
  • ElastiCache management: added replication-group and subnet-group CRUD/tagging actions.
  • EventBridge Scheduler management: added schedule-group/schedule CRUD + tagging actions.
• Example of added capability (Terraform IAM policy):

  {
    Sid    = "EventBridgeScheduler"
    Effect = "Allow"
    Action = [
      "scheduler:CreateScheduleGroup",
      "scheduler:CreateSchedule",
      "scheduler:UpdateSchedule"
    ]
    Resource = "*"
  }

Validation

• make lint
• make test
• make docs-check
• terraform -chdir=phishing-platform-infra/terraform validate

Linked Work

• Issue:
• Milestone:

Deployment Notes

• New environment variables: None.
• Infra impact: Expands aws_iam_role_policy.github_actions_deploy to cover EC2/ElastiCache/Scheduler actions required by current Terraform resources.
• Docs updated: No.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR expands the IAM permissions granted to the GitHub Actions deploy role to support provisioning and managing Redis (ElastiCache), related EC2 networking resources, and EventBridge Scheduler resources from CI/CD.

Changes:

• Add EC2 permissions for VPC/subnet/security-group discovery and security group lifecycle management.
• Add ElastiCache Redis (replication group + subnet group) management permissions.
• Add EventBridge Scheduler (schedule groups + schedules) management permissions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.