From 1058f69973242e22dfff7a1b54a937185dbc99a2 Mon Sep 17 00:00:00 2001
From: Alex English <alex.english80@gmail.com>
Date: Fri, 18 Sep 2026 15:37:35 -0700
Subject: [PATCH 1/2] Link the task role output to the Container Permissions
 wiki page

---
 terraform/modules/container/outputs.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/modules/container/outputs.tf b/terraform/modules/container/outputs.tf
index 4d4d485..64bc64c 100644
--- a/terraform/modules/container/outputs.tf
+++ b/terraform/modules/container/outputs.tf
@@ -1,5 +1,5 @@
 output "task_role_arn" {
-  description = "ARN of the task role that this container uses. Good for setting up permissions like s3 access"
+  description = "ARN of the task role that this container uses. This is the role application code runs as, and the place project-specific AWS permissions go. See [Container Permissions](https://github.com/hackforla/incubator/wiki/Container-Permissions) on the incubator wiki for what it already grants and how to add to it."
   value = aws_iam_role.instance.arn
 }
 

From b6ac7762fa97eef5bcaaa0137df7b403e6e6b5d8 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 18 Sep 2026 22:38:18 +0000
Subject: [PATCH 2/2] terraform-docs: automated updates to Terraform modules
 README.md [skip ci]

---
 terraform/modules/container/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/modules/container/README.md b/terraform/modules/container/README.md
index 2942f06..f85e9f7 100644
--- a/terraform/modules/container/README.md
+++ b/terraform/modules/container/README.md
@@ -155,6 +155,6 @@ No modules.
 |------|-------------|
 | <a name="output_execution_role_arn"></a> [execution\_role\_arn](#output\_execution\_role\_arn) | ARN of the execution role generated for this container. It pulls the image, writes logs and reads secrets, scoped to this container's project. |
 | <a name="output_execution_role_name"></a> [execution\_role\_name](#output\_execution\_role\_name) | IAM role name of the execution role generated for this container. |
-| <a name="output_task_role_arn"></a> [task\_role\_arn](#output\_task\_role\_arn) | ARN of the task role that this container uses. Good for setting up permissions like s3 access |
+| <a name="output_task_role_arn"></a> [task\_role\_arn](#output\_task\_role\_arn) | ARN of the task role that this container uses. This is the role application code runs as, and the place project-specific AWS permissions go. See [Container Permissions](https://github.com/hackforla/incubator/wiki/Container-Permissions) on the incubator wiki for what it already grants and how to add to it. |
 | <a name="output_task_role_name"></a> [task\_role\_name](#output\_task\_role\_name) | IAM role name of the task role that this container uses. |
 <!-- END_TF_DOCS -->
\ No newline at end of file