2.191.0

cado-security · Oct 25, 2024 · d792e97 · d792e97
1 parent ca83ee7
commit d792e97
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/aws_v2/modules/iam/main.tf b/aws_v2/modules/iam/main.tf
@@ -315,7 +315,14 @@ resource "aws_iam_role_policy" "policy" {
         {
             "Sid": "RequiredForS3Import",
             "Effect": "Allow",
-            "Action": "s3:ListAllMyBuckets",
+            "Action": [
+                "s3:ListAllMyBuckets",
+                "s3:GetObject",
+                "s3:RestoreObject",
+                "s3:GetObjectTagging",
+                "s3:ListBucket",
+                "s3:GetBucketLocation"
+            ],
             "Resource": "*"
         },
         {

diff --git a/cross-account/CrossAccountPolicy.yaml b/cross-account/CrossAccountPolicy.yaml
@@ -35,7 +35,13 @@ Statement:
   - arn:aws:ssm:*::document/AWS-RunPowerShellScript
 - Sid: RequiredForS3Import
   Effect: Allow
-  Action: s3:ListAllMyBuckets
+  Action:
+  - s3:ListAllMyBuckets
+  - s3:GetObject
+  - s3:RestoreObject
+  - s3:GetObjectTagging
+  - s3:ListBucket
+  - s3:GetBucketLocation
   Resource: '*'
 - Sid: RequiredForKmsEncryptedEc2Import
   Effect: Allow