Merge pull request #943 from rust-lang/fix-content-team-permission-for-s3-bucket

fix content team permission for s3 bucket

Author: marcoieni

terragrunt/modules/aws-organization/content.tf

@@ -10,22 +10,30 @@ resource "aws_ssoadmin_permission_set_inline_policy" "content_s3_write" {
   inline_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
+      {
+        Sid    = "S3ListContentBucket"
+        Effect = "Allow"
+        Action = [
+          "s3:ListBucket",
+          "s3:GetBucketLocation",
+        ]
+        Resource = [
+          "arn:aws:s3:::rust-content-internal",
+          "arn:aws:s3:::rust-content-public"
+        ]
+      },
       {
         Sid    = "S3Permissions"
         Effect = "Allow"
         Action = [
           "s3:GetObject",
           "s3:PutObject",
           "s3:DeleteObject",
-          "s3:ListBucket",
-          "s3:GetBucketLocation",
         ]
-        Resource = "*"
-        Condition = {
-          StringEquals = {
-            "s3:ResourceTag/TeamAccess" = "content"
-          }
-        }
+        Resource = [
+          "arn:aws:s3:::rust-content-internal/*",
+          "arn:aws:s3:::rust-content-public/*"
+        ]
       },
       {
         Sid    = "CloudFrontUnrestrictedPermissions"