MESG-2877 add sourceAccount condition to trust policy

paxosglobal · Sep 19, 2024 · 0510bf0 · 0510bf0
1 parent 0712a7f
commit 0510bf0
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/iam.tf b/iam.tf
@@ -58,6 +58,12 @@ data "aws_iam_policy_document" "assume_role" {
       variable = "aws:SourceArn"
       values   = var.trusted_entities_assume_role_source_arns
     }
+
+    condition {
+      test     = "ForAnyValue:StringEquals"
+      variable = "aws:SourceAccount"
+      values   = [data.aws_caller_identity.current.account_id]
+    }
   }
 
   dynamic "statement" {