adam/meal-order-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/meal-order-manager.git synced 2026-10-05 08:22:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): omit checkcomponents from the ECS boundary in non-prod

Browse source
This commit is contained in:
Adam Moussa 2026-09-21 16:20:40 -04:00
parent 30f88729a6
commit 8a45903271
No known key found for this signature in database
2 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
terraform/iam.tf
View file

@ -45,11 +45,14 @@ data "aws_iam_policy_document" "ecs_task_boundary" {
resources = [aws_sqs_queue.jobs.arn] resources = [aws_sqs_queue.jobs.arn]
} }
statement { dynamic "statement" {
sid = "CheckcomponentsSend" for_each = var.checkcomponents_queue_arn == "" ? [] : [1]
effect = "Allow" content {
actions = ["sqs:SendMessage"] sid = "CheckcomponentsSend"
resources = compact([var.checkcomponents_queue_arn]) effect = "Allow"
actions = ["sqs:SendMessage"]
resources = [var.checkcomponents_queue_arn]
}
} }
statement { statement {

12
tests/test_terraform_iam.py Normal file
View file

@ -0,0 +1,12 @@
"""ECS task boundary stays a valid IAM document when Paychex is unset."""
from pathlib import Path
IAM = Path(__file__).resolve().parents[1] / "terraform" / "iam.tf"
def test_checkcomponents_send_omitted_when_queue_arn_empty():
text = IAM.read_text()
assert "compact([var.checkcomponents_queue_arn])" not in text
assert 'for_each = var.checkcomponents_queue_arn == "" ? [] : [1]' in text
assert 'sid = "CheckcomponentsSend"' in text