Skip to content

Commit 592c858

Browse files
committed
eli-445 correcting linting and checkov
1 parent f2d42ca commit 592c858

2 files changed

Lines changed: 10 additions & 2 deletions

File tree

infrastructure/stacks/iams-developer-roles/github_actions_iam_bootstrap_policies.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,11 @@ data "aws_iam_policy_document" "iam_bootstrap_iam_management" {
7272
"iam:Get*",
7373
"iam:List*",
7474
]
75-
resources = ["*"]
75+
resources = [
76+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*",
77+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/*",
78+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/*",
79+
]
7680
}
7781

7882
# DENY: Prevent modifying the bootstrap role itself

infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,11 @@ data "aws_iam_policy_document" "iam_bootstrap_permissions_boundary" {
357357
"iam:Get*",
358358
"iam:List*",
359359
]
360-
resources = ["*"]
360+
resources = [
361+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/*",
362+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/*",
363+
"arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/*",
364+
]
361365
}
362366

363367
# Allow Terraform state bucket access

0 commit comments

Comments
 (0)