fix: DBTP-1534 Add S3MigrationRole to the resources allowed to add po…

…licies and roles (#283)
uktrade · Nov 14, 2024 · 0a4130e · 0a4130e
1 parent d32d45e
commit 0a4130e
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/environment-pipelines/iam.tf b/environment-pipelines/iam.tf
@@ -858,7 +858,8 @@ data "aws_iam_policy_document" "iam" {
       resources = [
         "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*-${var.application}-*-conduitEcsTask",
         "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.application}-${statement.value.name}-CFNExecutionRole",
-        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.application}-${statement.value.name}-EnvManagerRole"
+        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.application}-${statement.value.name}-EnvManagerRole",
+        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*-S3MigrationRole",
       ]
     }
   }
@@ -875,7 +876,9 @@ data "aws_iam_policy_document" "iam" {
     actions = [
       "iam:UpdateAssumeRolePolicy"
     ]
-    resources = [for environment in local.environment_config : "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*-S3MigrationRole"]
+    resources = [
+      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*-S3MigrationRole"
+    ]
   }
 
   statement {