adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-05 22:11:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(iam): allow execute-api Invoke for meal-order weekly-menu boundary

Browse source
This commit is contained in:
Adam Moussa 2026-08-10 15:42:12 -04:00
parent 7ad46d9528
commit 7c43c867e3
No known key found for this signature in database
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
lib/deploy-substrate/deploy-substrate.template.yaml
View file

@ -682,6 +682,19 @@ Resources:
Resource:
- !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*"
- !Ref AWS::NoValue
# Weekly-menu OIDC role (githubdeploy-meal-order-manager-weekly-menu)
# invokes IAM-authenticated HttpApi publish routes. Identity policy
# pins the API id; boundary uses method/path only (PLAT-100).
- !If
- IsProdAccount
- Sid: MealOrderManagerExecuteApi
Effect: Allow
Action:
- execute-api:Invoke
Resource:
- !Sub "arn:aws:execute-api:us-east-1:${AWS::AccountId}:*/*/GET/api/publish/settings"
- !Sub "arn:aws:execute-api:us-east-1:${AWS::AccountId}:*/*/POST/api/publish/menu"
- !Ref AWS::NoValue
- !If
- IsProdAccount
- Sid: MealOrderManagerLambdaInvoke