Skip to content

Commit

Permalink
fix(iam): add permissions to generate infra plan
Browse files Browse the repository at this point in the history
Signed-off-by: Massimiliano Giovagnoli <[email protected]>
  • Loading branch information
maxgio92 committed Mar 21, 2024
1 parent f4e18fd commit f6f63c4
Show file tree
Hide file tree
Showing 2 changed files with 25 additions and 0 deletions.
20 changes: 20 additions & 0 deletions config/clusters/iam.tf
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,26 @@ module "test-infra_reader" {
]
policies = {
test-infra_read_access = "arn:aws:iam::aws:policy/ReadOnlyAccess"
test-infra_state_lock = "${aws_iam_policy.test-infra_state_lock.arn}"
}
}

resource "aws_iam_policy" "test-infra_state_lock" {
name_prefix = "github_actions-test-infra-cluster"
description = "Access policy for test-infra Terraform remote state lock"
policy = data.aws_iam_policy_document.test-infra_state_lock.json
}

data "aws_iam_policy_document" "test-infra_state_lock" {
statement {
sid = "DeployTestInfraClusterAccess"
effect = "Allow"
actions = [
"dynamodb:PutItem"
]
resources = [
"arn:aws:dynamodb:::table/${var.state_dynamodb_table_name}"
]
}
}

Expand Down
5 changes: 5 additions & 0 deletions config/clusters/iam_variables.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
variable "state_dynamodb_table_name" {
type = string
description = "The name of the DynamoDB table for the Terraform state"
default = "falco-test-infra-state-lock"
}

0 comments on commit f6f63c4

Please sign in to comment.