adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-03 01:03:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(iam): use lambda:* and events:* on afi hcptf apply scope

Browse source 
Provider refresh needs GetFunctionCodeSigningConfig and similar reads;
keep blast radius on afi-* function/layer/rule ARNs only.
This commit is contained in:
Adam Moussa 2026-08-05 12:59:19 -04:00
parent 991cff8333
commit 46829fc2c1
No known key found for this signature in database
1 changed files with 7 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
lib/terraform-substrate/terraform-substrate.template.yaml
View file

@ -433,12 +433,7 @@ Resources:
- Sid: RefreshLambda
Effect: Allow
Action:
- lambda:GetFunction
- lambda:GetFunctionConfiguration
- lambda:GetPolicy
- lambda:GetLayerVersion
- lambda:ListVersionsByFunction
- lambda:ListTags
- lambda:*
Resource:
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*"
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*"
@ -480,34 +475,15 @@ Resources:
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: LambdaFunctions
# lambda:*/events:* on stack prefixes — AWS provider reads many
# Get* attributes (e.g. GetFunctionCodeSigningConfig) that lag any
# enumerated allow-list (PLAT-56 first-apply misses).
- Sid: LambdaAll
Effect: Allow
Action:
- lambda:CreateFunction
- lambda:DeleteFunction
- lambda:GetFunction
- lambda:GetFunctionConfiguration
- lambda:UpdateFunctionCode
- lambda:UpdateFunctionConfiguration
- lambda:ListVersionsByFunction
- lambda:PublishVersion
- lambda:TagResource
- lambda:UntagResource
- lambda:ListTags
- lambda:AddPermission
- lambda:RemovePermission
- lambda:GetPolicy
- lambda:InvokeFunction
- lambda:*
Resource:
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*"
- Sid: LambdaLayers
Effect: Allow
Action:
- lambda:PublishLayerVersion
- lambda:DeleteLayerVersion
- lambda:GetLayerVersion
- lambda:ListLayerVersions
Resource:
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*"
- Sid: LambdaList
Effect: Allow
@ -519,17 +495,7 @@ Resources:
- Sid: EventBridgeRules
Effect: Allow
Action:
- events:PutRule
- events:DeleteRule
- events:DescribeRule
- events:EnableRule
- events:DisableRule
- events:PutTargets
- events:RemoveTargets
- events:ListTargetsByRule
- events:TagResource
- events:UntagResource
- events:ListTagsForResource
- events:*
Resource:
- !Sub "arn:aws:events:us-east-1:${AWS::AccountId}:rule/afi-*"
- Sid: CloudWatchLogs