expand s3 bucket permissions (#11)

* expand s3 permissions
ntno · Jul 21, 2023 · 16a1175 · 16a1175
1 parent 2fff7e0
commit 16a1175
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 14 deletions.
diff --git a/modules/ci-role/templates/read-write-temp-site.tftpl b/modules/ci-role/templates/read-write-temp-site.tftpl
@@ -6,19 +6,11 @@
             "Sid": "CreateDestroyCiBuckets",
             "Effect": "Allow",
             "Action": [
-                "s3:GetBucketPublicAccessBlock",
-                "s3:PutBucketPublicAccessBlock",
-                "s3:PutEncryptionConfiguration",
-                "s3:DeleteBucketWebsite",
-                "s3:GetBucketWebsite",
-                "s3:PutBucketWebsite",
-                "s3:PutBucketPolicy",
+                "s3:GetBucket*",
+                "s3:PutBucket*",
+                "s3:DeleteBucket*",
                 "s3:CreateBucket",
-                "s3:GetBucketAcl",
-                "s3:PutBucketAcl",
-                "s3:DeleteBucketPolicy",
-                "s3:DeleteBucket",
-                "s3:GetBucketPolicy",
+                "s3:PutEncryptionConfiguration",
                 "s3:GetEncryptionConfiguration"
             ],
             "Resource": [

diff --git a/modules/dynamic-ssm-policy/main.tf b/modules/dynamic-ssm-policy/main.tf
@@ -4,8 +4,8 @@ data "aws_region" "current" {}
 
 # handle when optional values are null
 locals {
-  read_path_count        = can(length(var.read)) ? length(var.read) : 0
-  write_path_count       = can(length(var.write)) ? length(var.write) : 0
+  read_path_count  = can(length(var.read)) ? length(var.read) : 0
+  write_path_count = can(length(var.write)) ? length(var.write) : 0
 }
 
 data "aws_iam_policy_document" "ssm_policy_document" {