From 313ffda9368be80b29dadc0c1588c0ab423d947f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Taveira=20Ara=C3=BAjo?= Date: Fri, 10 Feb 2023 12:30:05 -0800 Subject: [PATCH] fix: add `cloudformation:List*` to default actions (#45) As a result of AWS API change, `cloudformation:ListStacks` is required in addition to `cloudformation:DescribeStacks` in order to execute `DescribeStacks` without a target. --- modules/snapshot/README.md | 2 +- modules/snapshot/variables.tf | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/snapshot/README.md b/modules/snapshot/README.md index 4a81698..52777de 100644 --- a/modules/snapshot/README.md +++ b/modules/snapshot/README.md @@ -125,7 +125,7 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [action](#input\_action) | List of actions allowed by policy and periodically triggered. By default,
this list contains all policies which the lambda can act upon. You should
only override this list if you do not want to execute more actions as they
become available in future lambda upgrades. If you instead wish to extend
this list, or ignore a subset of actions, use \"include\" and \"exclude\". | `list(string)` | 
[
  "apigateway:Get*",
  "autoscaling:Describe*",
  "cloudformation:Describe*",
  "cloudfront:List*",
  "dynamodb:Describe*",
  "dynamodb:List*",
  "ec2:Describe*",
  "ecs:Describe*",
  "ecs:List*",
  "eks:Describe*",
  "eks:List*",
  "elasticbeanstalk:Describe*",
  "elasticache:Describe*",
  "elasticfilesystem:Describe*",
  "elasticloadbalancing:Describe*",
  "elasticmapreduce:Describe*",
  "elasticmapreduce:List*",
  "events:List*",
  "firehose:Describe*",
  "firehose:List*",
  "iam:Get*",
  "iam:List*",
  "kinesis:Describe*",
  "kinesis:List*",
  "kms:Describe*",
  "kms:List*",
  "lambda:List*",
  "logs:Describe*",
  "organizations:Describe*",
  "organizations:List*",
  "rds:Describe*",
  "redshift:Describe*",
  "route53:List*",
  "s3:GetBucket*",
  "s3:List*",
  "secretsmanager:List*",
  "sns:Get*",
  "sns:List*",
  "sqs:Get*",
  "sqs:List*",
  "synthetics:Describe*",
  "synthetics:List*"
]
| no | +| [action](#input\_action) | List of actions allowed by policy and periodically triggered. By default,
this list contains all policies which the lambda can act upon. You should
only override this list if you do not want to execute more actions as they
become available in future lambda upgrades. If you instead wish to extend
this list, or ignore a subset of actions, use \"include\" and \"exclude\". | `list(string)` | 
[
  "apigateway:Get*",
  "autoscaling:Describe*",
  "cloudformation:Describe*",
  "cloudformation:List*",
  "cloudfront:List*",
  "dynamodb:Describe*",
  "dynamodb:List*",
  "ec2:Describe*",
  "ecs:Describe*",
  "ecs:List*",
  "eks:Describe*",
  "eks:List*",
  "elasticbeanstalk:Describe*",
  "elasticache:Describe*",
  "elasticfilesystem:Describe*",
  "elasticloadbalancing:Describe*",
  "elasticmapreduce:Describe*",
  "elasticmapreduce:List*",
  "events:List*",
  "firehose:Describe*",
  "firehose:List*",
  "iam:Get*",
  "iam:List*",
  "kinesis:Describe*",
  "kinesis:List*",
  "kms:Describe*",
  "kms:List*",
  "lambda:List*",
  "logs:Describe*",
  "organizations:Describe*",
  "organizations:List*",
  "rds:Describe*",
  "redshift:Describe*",
  "route53:List*",
  "s3:GetBucket*",
  "s3:List*",
  "secretsmanager:List*",
  "sns:Get*",
  "sns:List*",
  "sqs:Get*",
  "sqs:List*",
  "synthetics:Describe*",
  "synthetics:List*"
]
| no | | [eventbridge\_name\_prefix](#input\_eventbridge\_name\_prefix) | Prefix used for eventbridge rule | `string` | `"observe-lambda-snapshot-"` | no | | [eventbridge\_schedule\_event\_bus\_name](#input\_eventbridge\_schedule\_event\_bus\_name) | Event Bus for EventBridge scheduled events | `string` | `"default"` | no | | [eventbridge\_schedule\_expression](#input\_eventbridge\_schedule\_expression) | Rate at which snapshot is triggered. Must be valid EventBridge expression | `string` | `"rate(3 hours)"` | no | diff --git a/modules/snapshot/variables.tf b/modules/snapshot/variables.tf index d6add4a..7d37acf 100644 --- a/modules/snapshot/variables.tf +++ b/modules/snapshot/variables.tf @@ -39,6 +39,7 @@ variable "action" { "apigateway:Get*", "autoscaling:Describe*", "cloudformation:Describe*", + "cloudformation:List*", "cloudfront:List*", "dynamodb:Describe*", "dynamodb:List*",