adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-05 06:01:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(iam): address review feedback

Browse source
This commit is contained in:
Adam Moussa 2026-09-24 19:30:57 -04:00
parent 5b63c703bc
commit b404de9466
No known key found for this signature in database
1 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
lib/seahaven-site-hcptf-stack.ts
View file

@ -60,7 +60,16 @@ export class SeahavenSiteHcptfStack extends cdk.Stack {
policies: [
{
policyName: "seahaven-site-plan-refresh",
policyDocument: planPolicy(account, bucket, functionArn, deployParams, wafParam, githubOidc, deployRole),
policyDocument: planPolicy(
account,
bucket,
functionArn,
deployParams,
wafParam,
githubOidc,
deployRole,
boundary,
),
},
],
tags: roleTags(),
@ -251,7 +260,10 @@ function scopedIamPolicy(account: string, deployRole: string, boundary: string):
"iam:DeletePolicyVersion",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListPolicyTags",
"iam:SetDefaultPolicyVersion",
"iam:TagPolicy",
"iam:UntagPolicy",
],
Resource: boundary,
},
@ -349,6 +361,7 @@ function planPolicy(
wafParam: string,
githubOidc: string,
deployRole: string,
boundary: string,
): iam.PolicyDocument {
return iam.PolicyDocument.fromJson({
Version: "2012-10-17",
@ -381,6 +394,12 @@ function planPolicy(
Action: ["iam:GetPolicy", "iam:GetPolicyVersion"],
Resource: "*",
},
{
Sid: "RefreshDeployBoundaryTags",
Effect: "Allow",
Action: "iam:ListPolicyTags",
Resource: boundary,
},
{
Sid: "RefreshOriginBucket",
Effect: "Allow",