adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-04 00:43:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): grant shoc-backend staging plan named inventory reads (PLAT-148)

Browse source
This commit is contained in:
Adam Moussa 2026-09-18 12:51:04 -04:00
parent 73608fc13d
commit 1c87a61cfc
No known key found for this signature in database
1 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
lib/terraform-substrate/terraform-substrate.template.yaml
View file

@ -3446,6 +3446,7 @@ Resources:
Effect: Allow
Action:
- acm:ListCertificates
- autoscaling:DescribeAutoScalingGroups
- ec2:DescribeSecurityGroups
- ec2:DescribeSubnets
- ec2:DescribeVpcs
@ -3456,12 +3457,26 @@ Resources:
- elasticbeanstalk:DescribeEnvironments
- elasticbeanstalk:ListTagsForResource
- rds:DescribeDBInstances
- route53:ListHostedZones
- route53:ListHostedZonesByName
Resource: "*"
# Elastic Beanstalk DescribeConfigurationSettings calls
# CreateBucket against its existing regional service bucket
# during both plan and apply refresh.
- Sid: AuthorizeExistingEbBucketDiscovery
Effect: Allow
Action:
- s3:CreateBucket
- s3:PutBucketOwnershipControls
Resource: arn:aws:s3:::elasticbeanstalk-us-east-1-396287094661
Condition:
StringEquals:
s3:x-amz-object-ownership: ObjectWriter
- Sid: ReadSharedCertificate
Effect: Allow
Action:
- acm:DescribeCertificate
- acm:GetCertificate
- acm:ListTagsForCertificate
Resource: arn:aws:acm:us-east-1:396287094661:certificate/2b78e74f-7b65-4b82-a413-7a498b102f00
- Sid: ReadSharedRdsTags
@ -3540,6 +3555,13 @@ Resources:
Condition:
StringEquals:
"iam:PermissionsBoundary": arn:aws:iam::396287094661:policy/shoc-backend-staging-runtime-boundary
- Sid: UpdateStagingRuntimeTrust
Effect: Allow
Action:
- iam:UpdateAssumeRolePolicy
- iam:UpdateRole
- iam:UpdateRoleDescription
Resource: arn:aws:iam::396287094661:role/shoc-backend-staging
- Sid: TagStagingRuntimeRole
Effect: Allow
Action: