new IAM permissions in response to prod deployment errors (temporary?)

silinternational · Mar 14, 2022 · 5019ff8 · 5019ff8
1 parent 25fdf73
commit 5019ff8
Showing 1 changed file with 32 additions and 0 deletions.
diff --git a/terraform/main.tf b/terraform/main.tf
@@ -9,6 +9,8 @@ module "serverless-user" {
   app_name           = "mfa-api"
   aws_region         = var.aws_region
   enable_api_gateway = true
+
+  extra_policies = [local.s3_policy]
 }
 
 output "serverless-access-key-id" {
@@ -18,3 +20,33 @@ output "serverless-secret-access-key" {
   value     = module.serverless-user.aws_secret_access_key
   sensitive = true
 }
+
+
+locals {
+  s3_policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Effect" : "Allow",
+        "Action" : [
+          "s3:GetBucketPolicy",
+        ],
+        "Resource" : [
+          "arn:aws:s3:::mfa-api-*-serverlessdeploymentbucket*"
+        ]
+      },
+      {
+        "Effect" : "Allow",
+        "Action" : [
+          "apigateway:UpdateRestApiPolicy",
+        ],
+        "Resource" : [
+          // dev-mfa-api
+          "arn:aws:apigateway:${var.aws_region}:*:restapis/7f2jflg37i",
+          // prod-mfa-api
+          "arn:aws:apigateway:${var.aws_region}:*:restapis/7hk96xvik6",
+        ]
+      },
+    ]
+  })
+}