adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-09-30 06:53:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request #101 from Sea-Haven-Industries/fix/meal-order-passrole-apigateway
Some checks are pending
Deploy / deploy-management (push) Waiting to run
Details
Deploy / deploy-external-dev (push) Waiting to run
Details
Deploy / deploy-security (push) Waiting to run
Details
Deploy / deploy-dev (push) Waiting to run
Details
Deploy / deploy-prod (push) Waiting to run
Details

Browse source 
fix(iam): allow PassRole to apigateway for meal-order authorizer (PLAT-97)
This commit is contained in:
Adam Moussa 2026-08-10 14:05:35 -04:00 • committed by GitHub
commit 84aa1a803e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
lib/terraform-substrate/terraform-substrate.template.yaml
View file

@ -1881,6 +1881,18 @@ Resources:
Action:
- ssm:DescribeParameters
Resource: "*"
# API Gateway Lambda authorizer requires PassRole to
# apigateway.amazonaws.com. Shared HcptfIamManagementPolicy only
# grants PassRole to lambda.amazonaws.com (see IAMPassRole comment).
- Sid: MealOrderPassRoleApiGateway
Effect: Allow
Action:
- iam:PassRole
Resource:
- !Sub "arn:aws:iam::${AWS::AccountId}:role/tf-managed/meal-order-manager-*"
Condition:
StringEquals:
"iam:PassedToService": "apigateway.amazonaws.com"
- Sid: ReadWafWebAcl
Effect: Allow
Action: