Narrow permissions

stevebux · stevebux · commit b49465fbdb4d · 2025-11-27T13:43:12.000Z
diff --git a/infrastructure/terraform/components/api/module_lambda_letter_stream_forwarder.tf b/infrastructure/terraform/components/api/module_lambda_letter_stream_forwarder.tf
@@ -63,7 +63,8 @@ data "aws_iam_policy_document" "letter_stream_forwarder_lambda" {
     effect = "Allow"
 
     actions = [
-      "kinesis:*",
+      "kinesis:DescribeStream",
+      "kinesis:PutRecord",
     ]
 
     resources = [

Original file line number	Diff line number	Diff line change
`@@ -63,7 +63,8 @@ data "aws_iam_policy_document" "letter_stream_forwarder_lambda" {`
`63`	`63`	`effect = "Allow"`
`64`	`64`
`65`	`65`	`actions = [`
`66`		`- "kinesis:*",`
	`66`	`+ "kinesis:DescribeStream",`
	`67`	`+ "kinesis:PutRecord",`
`67`	`68`	`]`
`68`	`69`
`69`	`70`	`resources = [`