Skip to content

Commit d9aaffc

Browse files
vik-nullifyvik-nullify
committed
fix cloudformation and tf templates
1 parent 987b6eb commit d9aaffc

File tree

4 files changed

+56
-129
lines changed

4 files changed

+56
-129
lines changed

‎aws-integration-setup/cloudformation/nullify-cloudformation-template.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,6 @@
102102
"Action": [
103103
"s3:GetObject",
104104
"s3:GetObject*",
105-
"s3:PutObject*",
106105
"s3:DeleteObject*",
107106
"s3:RestoreObject",
108107
"ecr:GetDownloadUrlForLayer",

‎aws-integration-setup/terraform/examples/basic/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ terraform {
1212
}
1313

1414
provider "aws" {
15-
region = "us-east-1"
15+
region = "ap-southeast-2"
1616
}
1717

1818
module "nullify_aws_integration" {
@@ -24,7 +24,7 @@ module "nullify_aws_integration" {
2424
nullify_role_arn = "arn:aws:iam::NULLIFY-ACCOUNT-ID:role/NULLIFY-ROLE-NAME"
2525

2626
# Optional - using defaults for most values
27-
aws_region = "us-east-1"
27+
aws_region = "ap-southeast-2"
2828

2929
# Custom tags
3030
tags = {

‎aws-integration-setup/terraform/examples/with-kubernetes/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ variable "nullify_role_arn" {
2222
variable "aws_region" {
2323
type = string
2424
description = "The AWS region where resources are deployed"
25-
default = "us-east-1"
25+
default = "ap-southeast-2"
2626
}
2727

2828
variable "eks_cluster_name" {

‎aws-integration-setup/terraform/modules/nullify-aws-integration/data.tf‎

Lines changed: 53 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -280,71 +280,8 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
280280
"launchwizard:Describe*",
281281
"launchwizard:GetWorkload",
282282
"launchwizard:List*",
283-
"lex:DescribeBot",
284-
"lex:DescribeBotAlias",
285-
"lex:DescribeBotChannel",
286-
"lex:DescribeBotLocale",
287-
"lex:DescribeBotReplica",
288-
"lex:DescribeBotVersion",
289-
"lex:DescribeExport",
290-
"lex:DescribeImport",
291-
"lex:DescribeIntent",
292-
"lex:DescribeResourcePolicy",
293-
"lex:DescribeSlot",
294-
"lex:DescribeSlotType",
295-
"lex:List*",
296283
"license-manager:List*",
297-
"lightsail:GetActiveNames",
298-
"lightsail:GetAlarms",
299-
"lightsail:GetAutoSnapshots",
300-
"lightsail:GetBlueprints",
301-
"lightsail:GetBucketAccessKeys",
302-
"lightsail:GetBucketBundles",
303-
"lightsail:GetBucketMetricData",
304-
"lightsail:GetBuckets",
305-
"lightsail:GetBundles",
306-
"lightsail:GetCertificates",
307-
"lightsail:GetCloudFormationStackRecords",
308-
"lightsail:GetContainerAPIMetadata",
309-
"lightsail:GetContainerImages",
310-
"lightsail:GetContainerServiceDeployments",
311-
"lightsail:GetContainerServiceMetricData",
312-
"lightsail:GetContainerServicePowers",
313-
"lightsail:GetContainerServices",
314-
"lightsail:GetDiskSnapshot",
315-
"lightsail:GetDiskSnapshots",
316-
"lightsail:GetDistributionBundles",
317-
"lightsail:GetDistributionLatestCacheReset",
318-
"lightsail:GetDistributionMetricData",
319-
"lightsail:GetDistributions",
320-
"lightsail:GetDomain",
321-
"lightsail:GetDomains",
322-
"lightsail:GetExportSnapshotRecords",
323-
"lightsail:GetInstancePortStates",
324-
"lightsail:GetInstances",
325-
"lightsail:GetInstanceSnapshot",
326-
"lightsail:GetInstanceSnapshots",
327-
"lightsail:GetInstanceState",
328-
"lightsail:GetLoadBalancer",
329-
"lightsail:GetLoadBalancerMetricData",
330-
"lightsail:GetLoadBalancers",
331-
"lightsail:GetLoadBalancerTlsCertificates",
332-
"lightsail:GetOperation",
333-
"lightsail:GetOperations",
334-
"lightsail:GetOperationsForResource",
335-
"lightsail:GetRegions",
336-
"lightsail:GetRelationalDatabaseBlueprints",
337-
"lightsail:GetRelationalDatabaseBundles",
338-
"lightsail:GetRelationalDatabaseEvents",
339-
"lightsail:GetRelationalDatabaseLogEvents",
340-
"lightsail:GetRelationalDatabaseLogStreams",
341-
"lightsail:GetRelationalDatabaseMetricData",
342-
"lightsail:GetRelationalDatabaseParameters",
343-
"lightsail:GetRelationalDatabases",
344-
"lightsail:GetRelationalDatabaseSnapshot",
345-
"lightsail:GetRelationalDatabaseSnapshots",
346-
"lightsail:GetStaticIp",
347-
"lightsail:GetStaticIps",
284+
"lightsail:Get*",
348285
"logs:Describe*",
349286
"logs:FilterLogEvents",
350287
"logs:List*",
@@ -353,27 +290,7 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
353290
"logs:StopLiveTail",
354291
"logs:StopQuery",
355292
"logs:TestMetricFilter",
356-
"m2:GetApplicationVersion",
357-
"m2:GetDataSetDetails",
358-
"m2:GetDataSetImportTask",
359-
"m2:GetDeployment",
360-
"m2:GetEnvironment",
361-
"m2:List*",
362293
"machinelearning:Describe*",
363-
"macie2:Get*",
364-
"macie2:GetFindingsPublicationConfiguration",
365-
"macie2:GetFindingStatistics",
366-
"macie2:GetInvitationsCount",
367-
"macie2:GetMacieSession",
368-
"macie2:GetMember",
369-
"macie2:GetResourceProfile",
370-
"macie2:GetRevealConfiguration",
371-
"macie2:GetSensitiveDataOccurrencesAvailability",
372-
"macie2:GetSensitivityInspectionTemplate",
373-
"macie2:GetUsageStatistics",
374-
"macie2:GetUsageTotals",
375-
"macie2:List*",
376-
"macie2:SearchResources",
377294
"managedblockchain:GetMember",
378295
"managedblockchain:GetNetwork",
379296
"managedblockchain:GetNode",
@@ -410,10 +327,11 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
410327
"nimble:List*",
411328
"notifications-contacts:List*",
412329
"notifications:Get*",
330+
"notifications:List*",
413331
"notifications:GetManagedNotificationEvent",
414332
"notifications:GetNotificationConfiguration",
415-
"notifications:GetNotificationEvent",
416333
"notifications:GetNotificationsAccessForOrganization",
334+
"notifications:GetNotificationEvent",
417335
"notifications:List*",
418336
"observabilityadmin:ListResourceTelemetry",
419337
"observabilityadmin:ListResourceTelemetryForOrganization",
@@ -468,13 +386,8 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
468386
"route53domains:Get*",
469387
"route53domains:List*",
470388
"route53domains:View*",
471-
"route53profiles:GetProfile",
472-
"route53profiles:GetProfileAssociation",
473-
"route53profiles:GetProfileResourceAssociation",
474-
"route53profiles:ListProfileAssociations",
475-
"route53profiles:ListProfileResourceAssociations",
476-
"route53profiles:ListProfiles",
477-
"route53profiles:ListTagsForResource",
389+
"route53profiles:Get*",
390+
"route53profiles:List*",
478391
"route53resolver:Get*",
479392
"route53resolver:List*",
480393
"rum:GetAppMonitor",
@@ -484,8 +397,8 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
484397
"s3-outposts:Get*",
485398
"s3-outposts:List*",
486399
"s3:Describe*",
487-
"s3:GetBucketLocation",
488400
"s3:List*",
401+
"s3:GetBucketLocation",
489402
"sagemaker:Describe*",
490403
"sagemaker:List*",
491404
"scheduler:List*",
@@ -530,8 +443,8 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
530443
"sns:List*",
531444
"sqs:List*",
532445
"ssm-contacts:List*",
533-
"ssm-quicksetup:List*",
534446
"ssm-sap:List*",
447+
"ssm-quicksetup:List*",
535448
"ssm:List*",
536449
"sso-directory:List*",
537450
"sso:List*",
@@ -546,13 +459,6 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
546459
"sts:GetSessionToken",
547460
"support:Describe*",
548461
"support:SearchForCases",
549-
"supportplans:ListSupportPlanModifiers",
550-
"sustainability:GetCarbonFootprintSummary",
551-
"swf:Count*",
552-
"swf:Describe*",
553-
"swf:List*",
554-
"synthetics:Describe*",
555-
"synthetics:List*",
556462
"tag:Describe*",
557463
"tag:Get*",
558464
"tax:ListTaxRegistrations",
@@ -571,36 +477,15 @@ data "aws_iam_policy_document" "readonly_policy_part2" {
571477
"verifiedpermissions:IsAuthorized",
572478
"verifiedpermissions:IsAuthorizedWithToken",
573479
"verifiedpermissions:List*",
574-
"vpc-lattice:GetAccessLogSubscription",
575-
"vpc-lattice:GetAuthPolicy",
576-
"vpc-lattice:GetListener",
577-
"vpc-lattice:GetResourcePolicy",
578-
"vpc-lattice:GetRule",
579-
"vpc-lattice:GetService",
580-
"vpc-lattice:GetServiceNetwork",
581-
"vpc-lattice:GetServiceNetworkServiceAssociation",
582-
"vpc-lattice:GetServiceNetworkVpcAssociation",
583-
"vpc-lattice:GetTargetGroup",
480+
"vpc-lattice:Get*",
584481
"vpc-lattice:List*",
585482
"waf-regional:List*",
586483
"waf:List*",
587484
"wafv2:CheckCapacity",
588485
"wafv2:Describe*",
589486
"wafv2:List*",
590487
"wellarchitected:ExportLens",
591-
"wellarchitected:GetAnswer",
592-
"wellarchitected:GetConsolidatedReport",
593-
"wellarchitected:GetLens",
594-
"wellarchitected:GetLensReview",
595-
"wellarchitected:GetLensReviewReport",
596-
"wellarchitected:GetLensVersionDifference",
597-
"wellarchitected:GetMilestone",
598-
"wellarchitected:GetProfile",
599-
"wellarchitected:GetProfileTemplate",
600-
"wellarchitected:GetReviewTemplate",
601-
"wellarchitected:GetReviewTemplateAnswer",
602-
"wellarchitected:GetReviewTemplateLensReview",
603-
"wellarchitected:GetWorkload",
488+
"wellarchitected:Get*",
604489
"wellarchitected:List*",
605490
"workdocs:CheckAlias",
606491
"workdocs:Describe*",
@@ -639,9 +524,52 @@ data "aws_iam_policy_document" "deny_actions_policy" {
639524
actions = [
640525
"s3:GetObject",
641526
"s3:GetObject*",
527+
"s3:DeleteObject*",
528+
"s3:RestoreObject",
642529
"ecr:GetDownloadUrlForLayer",
643530
"ecr:BatchGetImage",
644-
"ecr:GetAuthorizationToken"
531+
"ecr:GetAuthorizationToken",
532+
"ecr:PutImage",
533+
"ecr:InitiateLayerUpload",
534+
"ecr:UploadLayerPart",
535+
"ecr:CompleteLayerUpload",
536+
"secretsmanager:GetSecretValue",
537+
"secretsmanager:DescribeSecret",
538+
"ssm:GetParameter*",
539+
"ssm:PutParameter*",
540+
"ssm:DeleteParameter*",
541+
"kms:Decrypt",
542+
"kms:DescribeKey",
543+
"kms:GenerateDataKey*",
544+
"kms:CreateGrant",
545+
"lambda:InvokeFunction",
546+
"lambda:InvokeAsync",
547+
"sts:AssumeRole",
548+
"iam:PassRole",
549+
"iam:CreateRole",
550+
"iam:DeleteRole",
551+
"iam:AttachRolePolicy",
552+
"iam:DetachRolePolicy",
553+
"iam:PutRolePolicy",
554+
"iam:DeleteRolePolicy",
555+
"iam:CreateUser",
556+
"iam:DeleteUser",
557+
"iam:CreateAccessKey",
558+
"iam:DeleteAccessKey",
559+
"iam:UpdateAccessKey",
560+
"ec2:RunInstances",
561+
"ec2:TerminateInstances",
562+
"ec2:StopInstances",
563+
"ec2:StartInstances",
564+
"ec2:RebootInstances",
565+
"ec2:CreateSnapshot",
566+
"ec2:DeleteSnapshot",
567+
"ec2:CreateImage",
568+
"ec2:DeregisterImage",
569+
"logs:CreateLogStream",
570+
"logs:PutLogEvents",
571+
"logs:DeleteLogGroup",
572+
"logs:DeleteLogStream"
645573
]
646574
resources = ["*"]
647575
}

0 commit comments

Comments
 (0)