fix: add create policy version permission (#405)

* fix: add create policy version permission * fix: isolate create policy version permission
cds-snc · Jul 18, 2024 · 2442c72 · 2442c72
1 parent 42aa482
commit 2442c72
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/terraform/github-user.tf b/terraform/github-user.tf
@@ -56,14 +56,23 @@ resource "aws_iam_policy" "Route53TerraformDeploy" {
           "iam:ListAttachedRolePolicies",
           "iam:ListAttachedUserPolicies",
           "iam:UpdateAssumeRolePolicy",
-          "iam:ListPolicyVersions"
+          "iam:ListPolicyVersions",
         ],
         "Resource" : [
           "arn:aws:iam::866996500832:role/notify_prod_dns_manager",
           "arn:aws:iam::866996500832:policy/notify_prod_dns_manager_policy",
           "arn:aws:iam::866996500832:policy/Route53TerraformDeploy",
           "arn:aws:iam::866996500832:user/dns-github-deployer"
         ]
+      },
+      {
+        "Effect" : "Allow",
+        "Action" : [
+          "iam:CreatePolicyVersion",
+        ],
+        "Resource" : [
+          "arn:aws:iam::866996500832:policy/notify_prod_dns_manager_policy",
+        ]
       }
     ]
   })