feat: allow sts:TagSession when assuming metadata copy role (#6183)

ministryofjustice · Nov 26, 2024 · 2bc6cb9 · 2bc6cb9
1 parent 271c199
commit 2bc6cb9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/.../analytical-platform-data-production/github-actions-roles/mojas-create-a-derived-table.tf b/.../analytical-platform-data-production/github-actions-roles/mojas-create-a-derived-table.tf
@@ -94,7 +94,7 @@ data "aws_iam_policy_document" "create_a_derived_table" {
   statement {
     sid       = "AllowAssumeAPComputeMetadataTransferRole"
     effect    = "Allow"
-    actions   = ["sts:AssumeRole"]
+    actions   = ["sts:AssumeRole", "sts:TagSession"]
     resources = ["arn:aws:iam::${var.account_ids["analytical-platform-compute-production"]}:role/analytical-platform-cadet-runner-assumable"]
   }
 }