Update IAM Policy with latest allow all (#46)

* Update IAM Policy with latest allow all * Auto Format Co-authored-by: cloudpossebot <[email protected]>
cloudposse · Nov 2, 2022 · bf84d52 · bf84d52
1 parent be7bbee
commit bf84d52
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 11 deletions.
diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml
@@ -10,6 +10,7 @@ jobs:
     steps:
     - name: "Checkout source code at current commit"
       uses: actions/checkout@v2
+      # Leave pinned at 0.7.1 until https://github.com/mszostok/codeowners-validator/issues/173 is resolved
     - uses: mszostok/[email protected]
       if: github.event.pull_request.head.repo.full_name == github.repository
       name: "Full check of CODEOWNERS"

diff --git a/iam_policy_all.tf b/iam_policy_all.tf
@@ -10,6 +10,7 @@ data "aws_iam_policy_document" "all" {
     actions = [
       "apigateway:GET",
       "autoscaling:Describe*",
+      "backup:List*",
       "budgets:ViewBudget",
       "cloudfront:GetDistributionConfig",
       "cloudfront:ListDistributions",
@@ -38,50 +39,44 @@ data "aws_iam_policy_document" "all" {
       "es:ListTags",
       "es:ListDomainNames",
       "es:DescribeElasticsearchDomains",
+      "events:CreateEventBus",
       "fsx:DescribeFileSystems",
       "fsx:ListTagsForResource",
       "health:DescribeEvents",
       "health:DescribeEventDetails",
       "health:DescribeAffectedEntities",
       "kinesis:List*",
       "kinesis:Describe*",
-      "kms:Decrypt",
-      "lambda:AddPermission",
       "lambda:GetPolicy",
       "lambda:List*",
-      "lambda:RemovePermission",
-      "logs:TestMetricFilter",
-      "logs:PutSubscriptionFilter",
       "logs:DeleteSubscriptionFilter",
       "logs:DescribeLogGroups",
       "logs:DescribeLogStreams",
       "logs:DescribeSubscriptionFilters",
       "logs:FilterLogEvents",
       "logs:PutSubscriptionFilter",
       "logs:TestMetricFilter",
-      "organizations:DescribeOrganization",
+      "organizations:Describe*",
+      "organizations:List*",
       "rds:Describe*",
       "rds:List*",
       "redshift:DescribeClusters",
       "redshift:DescribeLoggingStatus",
       "route53:List*",
-      "s3:GetAccountPublicAccessBlock",
       "s3:GetBucketLogging",
       "s3:GetBucketLocation",
       "s3:GetBucketNotification",
       "s3:GetBucketTagging",
       "s3:ListAllMyBuckets",
       "s3:PutBucketNotification",
-      "s3:ListBucket",
-      "s3:ListObjects",
-      "s3:GetObject",
       "ses:Get*",
       "sns:List*",
       "sns:Publish",
       "sqs:ListQueues",
       "states:ListStateMachines",
       "states:DescribeStateMachine",
-      "support:*",
+      "support:DescribeTrustedAdvisor*",
+      "support:RefreshTrustedAdvisorCheck",
       "tag:GetResources",
       "tag:GetTagKeys",
       "tag:GetTagValues",