add permissions for managing SNS topics (#1775)

cloud-gov · Sep 20, 2024 · a25af4b · a25af4b
1 parent 2b97475
commit a25af4b
Showing 1 changed file with 17 additions and 0 deletions.
diff --git a/terraform/modules/external_domain_broker/iam.tf b/terraform/modules/external_domain_broker/iam.tf
@@ -221,6 +221,23 @@ data "aws_iam_policy_document" "external_domain_broker_manage_protections_policy
  values = [aws_iam_user.iam_user.arn]
  }
  }
+
+ statement {
+ actions = [
+ "sns:CreateTopic",
+ "sns:DeleteTopic",
+ "sns:TagResource",
+ "sns:UntagResource"
+ ]
+ resources = [
+ "arn:${var.aws_partition}:sns:${var.aws_region}:${var.account_id}:cg-external-domains-*"
+ ]
+ condition {
+ test = "StringEquals"
+ variable = "aws:PrincipalArn"
+ values = [aws_iam_user.iam_user.arn]
+ }
+ }
 }
 
 resource "aws_iam_user" "iam_user" {