fix(iam): split paychex plan lambda list onto Resource *

2026-10-07 16:08:55 +00:00 · 2026-08-27 17:40:05 -04:00 · 2026-08-27 17:40:05 -04:00 · 7348ab9845
commit 7348ab9845
parent 0c05f629b3
1 changed files with 7 additions and 1 deletions
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@ -792,9 +792,15 @@ Resources:
                Effect: Allow
                Action:
                  - lambda:Get*
-                  - lambda:List*
                Resource:
                  - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:paychex-*"
+              # Collection/list APIs authorize only against Resource "*".
+              - Sid: RefreshLambdaList
+                Effect: Allow
+                Action:
+                  - lambda:ListFunctions
+                  - lambda:GetAccountSettings
+                Resource: "*"
              - Sid: RefreshArtifactsBucket
                Effect: Allow
                Action: