[CANOFY-107] Update Shared OCR Server IAM Policy¶

Type: Story
Epic: New Client Onboarding — Automated AWS + Frappe Provisioning
Stage key: ocr_policy_update (pipeline stage 7 of 15)
Component: utils/aws_client.py

User Story¶

As an operations engineer,
I want the shared OCR server's IAM role automatically granted access to
each new client's S3 bucket,
so that the OCR pipeline can read/write that client's documents without
a manual IAM console edit per client.

Description¶

The OCR server is a shared, multi-tenant instance whose IAM role needs read/
write access to every client's bucket (added incrementally, one client at a
time, as they onboard). This stage adds the new client's bucket ARN (from
stage 5) to that existing role's policy — it must be additive only; it must
never replace or remove existing clients' bucket grants.

This is a shared-resource mutation and the highest-blast-radius step in
early onboarding — a bug here can affect every other already-onboarded
client, not just the one being onboarded.

Configuration / Prerequisites¶

• OCR Server Config.ocr_server must point at the real shared OCR AWS
  Server record, with its IAM role name known.
• Depends on stage 5 (s3_bucket_name).

Acceptance Criteria¶

• New client's bucket ARN is added to the OCR role's policy.
• Every previously-granted client bucket ARN remains present and
  unchanged after this stage runs — verified by diffing the policy
  document before/after, not just spot-checking the new entry.
• Re-running this stage for the same client (retry scenario) does not
  create duplicate statements in the policy document.
• If OCR Server Config is unset/misconfigured, the stage fails with a
  clear, specific error (this must NOT be a silent no-op, unlike the
  later ocr_register content-registration stage which is intentionally
  best-effort).

Test Cases¶