fix: Give SNS feedback access to CloudWatch #237
Conversation
iam.tf
Outdated
| @@ -31,6 +47,11 @@ resource "aws_iam_role" "sns_feedback_role" { | |||
| permissions_boundary = var.sns_topic_feedback_role_permissions_boundary | |||
| assume_role_policy = data.aws_iam_policy_document.sns_feedback[0].json | |||
|
|
|||
| inline_policy { | |||
There was a problem hiding this comment.
5 cents... that inline_policy is going to be deprecated in the future releases of Terraform AWS provider (see changelog from yesterday). I didn't research if this is affecting us here...
There was a problem hiding this comment.
Interesting! It looks like aws_iam_role_policy is the new recommended way to do an inline policy, I'll move to that instead
Alternatively, I could switch this to use the CloudWatchLogsFullAccess managed policy? That grants logs:*, which is more than we need, so maybe not ideal
I'll also add a code comment referencing this: https://repost.aws/knowledge-center/monitor-sns-texts-cloudwatch
There was a problem hiding this comment.
@antonbabenko could you take another look please? Just updated
aldenquimby
changed the title
Description
Motivation and Context
Breaking Changes
How Has This Been Tested?
examples/*to demonstrate and validate my change(s)examples/*projectspre-commit run -aon my pull request