Restrict permissions on aws_iam_policy_document (#23)

* restrict permissions on runtask action

* fix typo

Author: he2ss

main.tf

@@ -17,6 +17,11 @@ data "aws_iam_policy_document" "scheduled_task_cw_event_role_cloudwatch_policy"
     effect    = "Allow"
     actions   = ["ecs:RunTask"]
     resources = ["*"]
+    condition {
+      test     = "ArnEquals"
+      variable = "ecs:cluster"
+      values   = [var.ecs_cluster_arn]
+    }
   }
   statement {
     actions   = ["iam:PassRole"]