mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 06:53:17 +00:00
db9465deda
* fix(iam): allow shoc-backend HCP apply to write deploy SSM and matching githubdeploy trust (PLAT-148) * fix(iam): grant shoc-backend staging plan named inventory reads (PLAT-148) * fix(iam): allow staging githubdeploy to GetObject release zips (PLAT-148) * fix(iam): allow staging githubdeploy to write EB processed extensions (PLAT-148) * fix(iam): allow staging githubdeploy GetObjectAcl on release zips (PLAT-148) * fix(iam): grant staging githubdeploy named S3 reads on EB resources prefix (PLAT-148) * fix(iam): allow staging githubdeploy to delete EB version cache objects (PLAT-148) * fix(iam): scope staging githubdeploy S3 object access to the EB bucket (PLAT-148) * fix(iam): allow staging githubdeploy PutObjectVersionAcl on EB artifacts (PLAT-148) * fix(iam): allow staging githubdeploy GetBucketPolicy on the EB bucket (PLAT-148) * fix(iam): scope staging githubdeploy S3 objects to SHOC and staging EB prefixes (PLAT-148)
52 lines
1.6 KiB
JSON
52 lines
1.6 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "ProtectOtherDeploymentPrincipalTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"NotResource": [
|
|
"arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-dev",
|
|
"arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-staging"
|
|
],
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectShocBackendDevGithubTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"Resource": "arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-dev",
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/hcptf-shoc-backend-dev"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "ProtectShocBackendStagingGithubTrust",
|
|
"Effect": "Deny",
|
|
"Action": "iam:UpdateAssumeRolePolicy",
|
|
"Resource": "arn:aws:iam::396287094661:role/githubdeploy-shoc-backend-staging",
|
|
"Condition": {
|
|
"ArnNotLike": {
|
|
"aws:PrincipalArn": [
|
|
"arn:aws:iam::396287094661:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::396287094661:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::396287094661:role/hcptf-shoc-backend-staging"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|