adam/meal-order-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/meal-order-manager.git synced 2026-09-30 04:13:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): omit checkcomponents from the ECS boundary in non-prod (#202)
Some checks are pending
Deploy API / Resolve target (push) Waiting to run
Details
Deploy API / Deploy API to (push) Blocked by required conditions
Details

Browse source
This commit is contained in:
Adam Moussa 2026-09-21 16:26:17 -04:00 • committed by GitHub
parent 30f88729a6
commit 697deb94fd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
terraform/iam.tf
View file

@ -45,11 +45,14 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
resources = [aws_sqs_queue.jobs.arn]
}
statement {
sid = "CheckcomponentsSend"
effect = "Allow"
actions = ["sqs:SendMessage"]
resources = compact([var.checkcomponents_queue_arn])
dynamic "statement" {
for_each = var.checkcomponents_queue_arn == "" ? [] : [1]
content {
sid = "CheckcomponentsSend"
effect = "Allow"
actions = ["sqs:SendMessage"]
resources = [var.checkcomponents_queue_arn]
}
}
statement {

12
tests/test_terraform_iam.py Normal file
View file

@ -0,0 +1,12 @@
"""ECS task boundary stays a valid IAM document when Paychex is unset."""
from pathlib import Path
IAM = Path(__file__).resolve().parents[1] / "terraform" / "iam.tf"
def test_checkcomponents_send_omitted_when_queue_arn_empty():
text = IAM.read_text()
assert "compact([var.checkcomponents_queue_arn])" not in text
assert 'for_each = var.checkcomponents_queue_arn == "" ? [] : [1]' in text
assert 'sid = "CheckcomponentsSend"' in text