Merge branch 'main' into bugfix/eja-eli-388-enable-audit-logging-by-adding-permissions

eddalmond1 · web-flow · commit 43abb8132c73 · 2025-08-07T11:47:56.000+01:00
diff --git a/infrastructure/stacks/api-layer/s3_buckets.tf b/infrastructure/stacks/api-layer/s3_buckets.tf
@@ -16,8 +16,3 @@ module "s3_audit_bucket" {
   stack_name             = local.stack_name
   workspace              = terraform.workspace
 }
-
-resource "aws_s3_account_public_access_block" "block_public_access" {
-  block_public_acls   = true
-  block_public_policy = true
-}
diff --git a/infrastructure/stacks/iams-developer-roles/github_actions_policies.tf b/infrastructure/stacks/iams-developer-roles/github_actions_policies.tf
@@ -164,14 +164,6 @@ resource "aws_iam_policy" "s3_management" {
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore-access-logs",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore-access-logs/*",
         ]
-      },
-      {
-        Effect = "Allow",
-        Action = [
-          "s3:GetAccountPublicAccessBlock",
-          "s3:PutAccountPublicAccessBlock"
-        ],
-        Resource = "*"
       }
     ]
   })

Original file line number	Diff line number	Diff line change
`@@ -16,8 +16,3 @@ module "s3_audit_bucket" {`
`16`	`16`	`stack_name = local.stack_name`
`17`	`17`	`workspace = terraform.workspace`
`18`	`18`	`}`
`19`		`-`
`20`		`-resource "aws_s3_account_public_access_block" "block_public_access" {`
`21`		`- block_public_acls = true`
`22`		`- block_public_policy = true`
`23`		`-}`
Original file line number	Diff line number	Diff line change
`@@ -164,14 +164,6 @@ resource "aws_iam_policy" "s3_management" {`
`164`	`164`	`"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore-access-logs",`
`165`	`165`	`"arn:aws:s3:::eligibility-signposting-api-${var.environment}-truststore-access-logs/",`
`166`	`166`	`]`
`167`		`- },`
`168`		`- {`
`169`		`- Effect = "Allow",`
`170`		`- Action = [`
`171`		`- "s3:GetAccountPublicAccessBlock",`
`172`		`- "s3:PutAccountPublicAccessBlock"`
`173`		`- ],`
`174`		`- Resource = "*"`
`175`	`167`	`}`
`176`	`168`	`]`
`177`	`169`	`})`