adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-07 16:08:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(iam): tighten procurement-ingest apply-role scopes (PLAT-86)

Browse source
This commit is contained in:
Adam Moussa 2026-08-06 17:05:22 -04:00
parent 373c9a29cb
commit a9fd8d0227
No known key found for this signature in database
1 changed files with 31 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
lib/terraform-substrate/terraform-substrate.template.yaml
View file

@ -1139,7 +1139,26 @@ Resources:
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:po-*"
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:workorder-*"
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:procurement-api"
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:event-source-mapping:*"
# Event source mapping ARNs are UUID-keyed; AWS authorises Create against
# FunctionArn. Get/Update/Delete also take the mapping ARN, so Resource
# stays "*" but FunctionArn is constrained to this stack's functions.
- Sid: LambdaEventSourceMappings
Effect: Allow
Action:
- lambda:CreateEventSourceMapping
- lambda:DeleteEventSourceMapping
- lambda:UpdateEventSourceMapping
- lambda:GetEventSourceMapping
- lambda:ListTags
- lambda:TagResource
- lambda:UntagResource
Resource: "*"
Condition:
"ForAnyValue:StringLike":
"lambda:FunctionArn":
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:po-*"
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:workorder-*"
- !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:procurement-api"
- Sid: LambdaList
Effect: Allow
Action:
@ -1240,10 +1259,10 @@ Resources:
Action:
- apigateway:*
Resource:
- !Sub "arn:aws:apigateway:us-east-1::/restapis"
- !Sub "arn:aws:apigateway:us-east-1::/restapis/*"
- arn:aws:apigateway:us-east-1::/domainnames
- arn:aws:apigateway:us-east-1::/domainnames/*
- !Sub "arn:aws:apigateway:us-east-1::/restapis/mvul1efda2"
- !Sub "arn:aws:apigateway:us-east-1::/restapis/mvul1efda2/*"
- arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com
- arn:aws:apigateway:us-east-1::/domainnames/procurement-api.seahaven.com/*
- Sid: SesReceiptRules
Effect: Allow
Action:
@ -1251,8 +1270,14 @@ Resources:
- ses:UpdateReceiptRule
- ses:DeleteReceiptRule
- ses:DescribeReceiptRule
- ses:DescribeReceiptRuleSet
- ses:SetReceiptRulePosition
Resource:
- !Sub "arn:aws:ses:us-east-1:${AWS::AccountId}:receipt-rule-set/INBOUND_MAIL:receipt-rule/ExistingRuleSetPoEmailRuleAC8E9C87-qwGDj9lBoL1G"
- !Sub "arn:aws:ses:us-east-1:${AWS::AccountId}:receipt-rule-set/INBOUND_MAIL:receipt-rule/ExistingRuleSetWorkorderEmailRuleEA29F845-PKtaDBvIg61a"
- Sid: SesDescribeRuleSet
Effect: Allow
Action:
- ses:DescribeReceiptRuleSet
Resource: "*"
- Sid: ShocKms
Effect: Allow