From 91cf0bd2ffd70568468488e30e1ed5e547a36c93 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 1 Oct 2026 13:48:21 -0400
Subject: [PATCH] fix(infra): scope DLM snapshot sharing to snapshot ARNs

ModifySnapshotAttribute on every resource can share a snapshot. The boundary allows it only on snapshot ARNs.
---
 terraform/iam.tf | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/terraform/iam.tf b/terraform/iam.tf
index 71dde07..a299881 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -190,12 +190,18 @@ data "aws_iam_policy_document" "dlm_boundary" {
       "ec2:DescribeVolumes",
       "ec2:DisableFastSnapshotRestores",
       "ec2:EnableFastSnapshotRestores",
-      "ec2:ModifySnapshotAttribute",
       "ec2:ModifySnapshotTier",
     ]
     resources = ["*"]
   }
 
+  statement {
+    sid       = "SnapshotSharing"
+    effect    = "Allow"
+    actions   = ["ec2:ModifySnapshotAttribute"]
+    resources = ["arn:aws:ec2:*:*:snapshot/*"]
+  }
+
   statement {
     sid    = "SnapshotRules"
     effect = "Allow"