remove wild cards from iam policy

SPHTech-Platform · Feb 2, 2024 · 07f1325 · 07f1325
1 parent 13fbf30
commit 07f1325
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/examples/fargate/data.tf b/examples/fargate/data.tf
@@ -27,7 +27,7 @@ data "aws_subnets" "private" {
 data "aws_iam_policy_document" "execution_custom_policy" {
   statement {
     actions   = ["logs:CreateLogGroup"]
-    resources = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:*"]
+    resources = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/ecs/${var.name}/*"]
   }
 }
 
@@ -37,7 +37,7 @@ data "aws_iam_policy_document" "task_ecs_exec_policy" {
       "kms:Decrypt",
     ]
 
-    resources = ["arn:aws:kms:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:key:/*"]
+    resources = [module.fargate_cluster.ecs_cluster_kms_arn]
   }
   statement {
     actions = [