Putting Describe BGD in different statement

ministryofjustice · Feb 23, 2024 · af27d2e · af27d2e
1 parent a25021a
commit af27d2e
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/main.tf b/main.tf
@@ -259,7 +259,6 @@ data "aws_iam_policy_document" "irsa" {
     actions = [
       "rds:CreateBlueGreenDeployment",
       "rds:DeleteBlueGreenDeployment",
-      "rds:DescribeBlueGreenDeployments",
       "rds:SwitchoverBlueGreenDeployment",
     ]
 
@@ -283,6 +282,17 @@ data "aws_iam_policy_document" "irsa" {
       local.db_pg_arn
     ]
   }
+  statement {
+    sid    = "AllowDescribeBGDFor${random_id.id.hex}"
+    effect = "Allow"
+    actions = [
+      "rds:DescribeBlueGreenDeployments",
+    ]
+
+    resources = [
+      "arn:aws:rds:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:deployment:*",
+    ]
+  }
 }
 
 resource "aws_iam_policy" "irsa" {