adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-07 11:28:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request #78 from Sea-Haven-Industries/fix/hcptf-afi-provider-read-actions
Some checks are pending
Deploy / deploy-management (push) Waiting to run
Details
Deploy / deploy-external-dev (push) Waiting to run
Details
Deploy / deploy-security (push) Waiting to run
Details
Deploy / deploy-dev (push) Waiting to run
Details
Deploy / deploy-prod (push) Waiting to run
Details

Browse source 
fix(iam): use lambda:* and events:* on afi hcptf apply scope (PLAT-56)
This commit is contained in:
Adam Moussa 2026-08-05 12:59:34 -04:00 • committed by GitHub
commit 2c5c644a5e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
lib/terraform-substrate/terraform-substrate.template.yaml
View file

@ -433,12 +433,7 @@ Resources:
- Sid: RefreshLambda - Sid: RefreshLambda
Effect: Allow Effect: Allow
Action: Action:
- lambda:GetFunction - lambda:*
- lambda:GetFunctionConfiguration
- lambda:GetPolicy
- lambda:GetLayerVersion
- lambda:ListVersionsByFunction
- lambda:ListTags
Resource: Resource:
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*" - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*"
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*" - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*"
@ -480,34 +475,15 @@ Resources:
PolicyDocument: PolicyDocument:
Version: "2012-10-17" Version: "2012-10-17"
Statement: Statement:
- Sid: LambdaFunctions # lambda:*/events:* on stack prefixes — AWS provider reads many
# Get* attributes (e.g. GetFunctionCodeSigningConfig) that lag any
# enumerated allow-list (PLAT-56 first-apply misses).
- Sid: LambdaAll
Effect: Allow Effect: Allow
Action: Action:
- lambda:CreateFunction - lambda:*
- lambda:DeleteFunction
- lambda:GetFunction
- lambda:GetFunctionConfiguration
- lambda:UpdateFunctionCode
- lambda:UpdateFunctionConfiguration
- lambda:ListVersionsByFunction
- lambda:PublishVersion
- lambda:TagResource
- lambda:UntagResource
- lambda:ListTags
- lambda:AddPermission
- lambda:RemovePermission
- lambda:GetPolicy
- lambda:InvokeFunction
Resource: Resource:
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*" - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*"
- Sid: LambdaLayers
Effect: Allow
Action:
- lambda:PublishLayerVersion
- lambda:DeleteLayerVersion
- lambda:GetLayerVersion
- lambda:ListLayerVersions
Resource:
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*" - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*"
- Sid: LambdaList - Sid: LambdaList
Effect: Allow Effect: Allow
@ -519,17 +495,7 @@ Resources:
- Sid: EventBridgeRules - Sid: EventBridgeRules
Effect: Allow Effect: Allow
Action: Action:
- events:PutRule - events:*
- events:DeleteRule
- events:DescribeRule
- events:EnableRule
- events:DisableRule
- events:PutTargets
- events:RemoveTargets
- events:ListTargetsByRule
- events:TagResource
- events:UntagResource
- events:ListTagsForResource
Resource: Resource:
- !Sub "arn:aws:events:us-east-1:${AWS::AccountId}:rule/afi-*" - !Sub "arn:aws:events:us-east-1:${AWS::AccountId}:rule/afi-*"
- Sid: CloudWatchLogs - Sid: CloudWatchLogs