skip: Merge pull request #184 from epam/upd_iam

upd: update policy IAM permissions file for 143,144,159, 462
epam · Sep 25, 2024 · 6e69030 · 6e69030
2 parents f2c2989 + 6c8c1e5
commit 6e69030
Show file tree

Hide file tree

Showing 6 changed files with 8 additions and 10 deletions.
diff --git a/iam/All-permissions_1.json b/iam/All-permissions_1.json
@@ -70,10 +70,10 @@
                 "ec2:DescribeNetworkAcls",
                 "ec2:DescribeNetworkInterfaces",
                 "ec2:DescribeRegions",
-                "ec2:DescribeReservedDBInstances",
-                "ec2:DescribeReservedElasticsearchInstances",
+                "rds:DescribeReservedDBInstances",
+                "es:DescribeReservedElasticsearchInstances",
                 "ec2:DescribeReservedInstances",
-                "ec2:DescribeReservedNodes",
+                "redshift:DescribeReservedNodes",
                 "ec2:DescribeRouteTables",
                 "ec2:DescribeSecurityGroupReferences",
                 "ec2:DescribeSecurityGroupRules",
@@ -174,7 +174,6 @@
                 "kms:GetKeyRotationStatus",
                 "kms:ListAliases",
                 "kms:ListKeys",
-                "kms:listAliases",
                 "lambda:GetFunction",
                 "lambda:GetFunctionCodeSigningConfig",
                 "lambda:GetFunctionConcurrency",

diff --git a/iam/All-permissions_2.json b/iam/All-permissions_2.json
@@ -20,7 +20,6 @@
                 "s3:GetBucketOwnershipControls",
                 "s3:GetBucketPolicy",
                 "s3:GetBucketPublicAccessBlock",
-                "s3:GetBucketReplication",
                 "s3:GetBucketTagging",
                 "s3:GetBucketVersioning",
                 "s3:GetBucketWebsite",

diff --git a/terraform/ecc-aws-143-bucket_object-level_logging_for_write_enabled/iam/143-policy.json b/terraform/ecc-aws-143-bucket_object-level_logging_for_write_enabled/iam/143-policy.json
@@ -6,6 +6,7 @@
             "Action": [ 
                 "iam:ListAccountAliases",
                 "cloudtrail:DescribeTrails",
+                "cloudtrail:GetTrailStatus",
                 "cloudtrail:GetEventSelectors"
             ],
             "Resource": "*"

diff --git a/terraform/ecc-aws-144-bucket_object-level_logging_for_read_enabled/iam/144-policy.json b/terraform/ecc-aws-144-bucket_object-level_logging_for_read_enabled/iam/144-policy.json
@@ -6,7 +6,8 @@
             "Action": [ 
                 "iam:ListAccountAliases",
                 "cloudtrail:DescribeTrails",
-                "cloudtrail:GetEventSelectors"
+                "cloudtrail:GetEventSelectors",
+                "cloudtrail:GetTrailStatus"
             ],
             "Resource": "*"
         }

diff --git a/terraform/ecc-aws-159-rds_critical_cluster_events_notification_exists/iam/159-policy.json b/terraform/ecc-aws-159-rds_critical_cluster_events_notification_exists/iam/159-policy.json
@@ -4,10 +4,10 @@
         {
             "Effect": "Allow",
             "Action": [
+                "iam:ListAccountAliases",
                 "rds:DescribeEventSubscriptions",
-				"iam:ListAccountAliases",
-                "rds:DescribeDBInstances",
                 "sns:ListTopics",
+                "rds:DescribeDBClusters",
                 "sns:GetTopicAttributes"
             ],
             "Resource": "*"

diff --git a/terraform/ecc-aws-462-lambda_concurrency_enabled/iam/462-policy.json b/terraform/ecc-aws-462-lambda_concurrency_enabled/iam/462-policy.json
@@ -7,8 +7,6 @@
             "Action": [
                 "tag:GetResources",
                 "lambda:ListFunctions",
-                "lambda:GetFunctionConcurrency",
-                "lambda:GetFunctionConfiguration",
                 "lambda:GetFunction"
             ],
             "Resource": "*"