adam/file-share
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/file-share.git synced 2026-10-03 01:03:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(infra): scope DLM snapshot sharing to snapshot ARNs

Browse source 
ModifySnapshotAttribute on every resource can share a snapshot. The boundary allows it only on snapshot ARNs.
This commit is contained in:
Adam Moussa 2026-10-01 13:48:21 -04:00
parent 1a3c3d72a2
commit 91cf0bd2ff
No known key found for this signature in database
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
terraform/iam.tf
View file

@ -190,12 +190,18 @@ data "aws_iam_policy_document" "dlm_boundary" {
"ec2:DescribeVolumes",
"ec2:DisableFastSnapshotRestores",
"ec2:EnableFastSnapshotRestores",
"ec2:ModifySnapshotAttribute",
"ec2:ModifySnapshotTier",
]
resources = ["*"]
}
statement {
sid = "SnapshotSharing"
effect = "Allow"
actions = ["ec2:ModifySnapshotAttribute"]
resources = ["arn:aws:ec2:*:*:snapshot/*"]
}
statement {
sid = "SnapshotRules"
effect = "Allow"