Skip to content

Commit 7466630

Browse files
committed
Match development policy to deployment policy
1 parent d801788 commit 7466630

File tree

2 files changed

+3
-74
lines changed

2 files changed

+3
-74
lines changed

scripts/infrastructure/policies/development1-policy.json

Lines changed: 0 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -91,20 +91,6 @@
9191
],
9292
"Resource": ["arn:aws:cloudformation:*:${ACCOUNT_ID}:stack/*/*"]
9393
},
94-
{
95-
"Sid": "StepFunctionPermissions",
96-
"Effect": "Allow",
97-
"Action": [
98-
"states:DescribeStateMachine",
99-
"states:ListStateMachineVersions",
100-
"states:ListTagsForResource",
101-
"states:CreateStateMachine",
102-
"states:UpdateStateMachine",
103-
"states:DeleteStateMachine",
104-
"states:TagResource"
105-
],
106-
"Resource": ["arn:aws:states:*:${ACCOUNT_ID}:stateMachine:*"]
107-
},
10894
{
10995
"Sid": "Route53Permissions",
11096
"Effect": "Allow",
@@ -134,22 +120,6 @@
134120
],
135121
"Resource": ["*"]
136122
},
137-
{
138-
"Sid": "EventsPermissions",
139-
"Effect": "Allow",
140-
"Action": [
141-
"events:TagResource",
142-
"events:PutRule",
143-
"events:DescribeRule",
144-
"events:ListTagsForResource",
145-
"events:DeleteRule",
146-
"events:PutTargets",
147-
"events:ListTargetsByRule",
148-
"events:RemoveTargets",
149-
"events:DisableRule"
150-
],
151-
"Resource": ["*"]
152-
},
153123
{
154124
"Sid": "VpcPermissionsPlan",
155125
"Effect": "Allow",
@@ -188,22 +158,6 @@
188158
],
189159
"Resource": ["arn:aws:ec2:eu-west-2:${ACCOUNT_ID}:vpc/vpc-*"]
190160
},
191-
{
192-
"Sid": "VpcEndpointPermissions",
193-
"Effect": "Allow",
194-
"Action": [
195-
"ec2:CreateVpcEndpoint",
196-
"ec2:CreateTags",
197-
"ec2:DeleteVpcEndpoints"
198-
],
199-
"Resource": ["arn:aws:ec2:eu-west-2:${ACCOUNT_ID}:vpc-endpoint/*"]
200-
},
201-
{
202-
"Sid": "VpcEndpointPermissions2",
203-
"Effect": "Allow",
204-
"Action": ["ec2:ModifyVpcEndpoint"],
205-
"Resource": ["arn:aws:ec2:eu-west-2:${ACCOUNT_ID}:vpc-endpoint/vpce-*"]
206-
},
207161
{
208162
"Sid": "SubnetPermissions",
209163
"Effect": "Allow",
@@ -232,7 +186,6 @@
232186
"Action": [
233187
"ec2:DeleteSecurityGroup",
234188
"ec2:RevokeSecurityGroupEgress",
235-
"ec2:ModifyVpcEndpoint",
236189
"ec2:AuthorizeSecurityGroupIngress",
237190
"ec2:AuthorizeSecurityGroupEgress"
238191
],

scripts/infrastructure/policies/development2-policy.json

Lines changed: 3 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -152,17 +152,7 @@
152152
"Resource": ["arn:aws:s3:::*"]
153153
},
154154
{
155-
"Sid": "S3ObjectPermissions",
156-
"Effect": "Allow",
157-
"Action": [
158-
"s3:DeleteObject",
159-
"s3:DeleteObjectVersion",
160-
"s3:DeleteBucket"
161-
],
162-
"Resource": ["arn:aws:s3:::*--etl/*"]
163-
},
164-
{
165-
"Sid": "ApigeeSecretsIntegrationPermissions",
155+
"Sid": "SecretsIntegrationPermissions",
166156
"Effect": "Allow",
167157
"Action": ["secretsmanager:GetSecretValue"],
168158
"Resource": [
@@ -172,21 +162,6 @@
172162
"arn:aws:secretsmanager:*:${ACCOUNT_ID}:secret:*-etl-notify-slack-webhook-url-*"
173163
]
174164
},
175-
{
176-
"Sid": "SQSPermissions",
177-
"Effect": "Allow",
178-
"Action": [
179-
"sqs:createqueue",
180-
"sqs:tagqueue",
181-
"sqs:setqueueattributes",
182-
"sqs:getqueueattributes",
183-
"sqs:listqueuetags",
184-
"sqs:deletequeue",
185-
"sqs:PurgeQueue",
186-
"sqs:GetQueueUrl"
187-
],
188-
"Resource": ["arn:aws:sqs:eu-west-2:${ACCOUNT_ID}:*-sqs*"]
189-
},
190165
{
191166
"Sid": "EventSourceMappingPermissions",
192167
"Effect": "Allow",
@@ -218,7 +193,6 @@
218193
"ssm:DescribeParameters",
219194
"dynamodb:ListTables",
220195
"firehose:ListDeliveryStreams",
221-
"sqs:listqueues",
222196
"states:ListStateMachines",
223197
"events:ListRules",
224198
"acm:ListCertificates",
@@ -232,6 +206,8 @@
232206
"SNS:ListTagsForResource",
233207
"budgets:ModifyBudget",
234208
"budgets:ViewBudget",
209+
"budgets:ListTagsForResource",
210+
"budgets:TagResource",
235211
"SNS:DeleteTopic",
236212
"SNS:CreateTopic",
237213
"SNS:TagResource",

0 commit comments

Comments
 (0)