Grant Control Panel role read policy permissions

ministryofjustice · Jun 3, 2024 · cf7d2c6 · cf7d2c6
1 parent 7fce043
commit cf7d2c6
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/terraform/aws/analytical-platform-development/cluster/iam-policies.tf b/terraform/aws/analytical-platform-development/cluster/iam-policies.tf
@@ -347,6 +347,15 @@ data "aws_iam_policy_document" "control_panel_api" {
     actions   = ["iam:DeletePolicy"]
     resources = ["arn:aws:iam::${var.account_ids["analytical-platform-development"]}:policy/${var.resource_prefix}-*"]
   }
+  statement {
+    sid    = "CanReadIAMPolicies"
+    effect = "Allow"
+    actions = [
+      "iam:GetPolicy",
+      "iam:GetPolicyVersion",
+    ]
+    resources = ["arn:aws:iam::${var.account_ids["analytical-platform-development"]}:policy/*"]
+  }
   statement {
     sid     = "CanAttachPolicies"
     effect  = "Allow"

diff --git a/terraform/aws/analytical-platform-production/cluster/iam-policies.tf b/terraform/aws/analytical-platform-production/cluster/iam-policies.tf
@@ -74,6 +74,15 @@ data "aws_iam_policy_document" "control_panel_api" {
     actions   = ["iam:DeletePolicy"]
     resources = ["arn:aws:iam::${var.account_ids["analytical-platform-data-production"]}:policy/${var.resource_prefix}-*"]
   }
+  statement {
+    sid    = "CanReadIAMPolicies"
+    effect = "Allow"
+    actions = [
+      "iam:GetPolicy",
+      "iam:GetPolicyVersion",
+    ]
+    resources = ["arn:aws:iam::${var.account_ids["analytical-platform-data-production"]}:policy/*"]
+  }
   statement {
     sid     = "CanAttachPolicies"
     effect  = "Allow"