From 5fc1abbb45704eb95c50ec5ccf9de81657ee4b07 Mon Sep 17 00:00:00 2001 From: Tim Thacker Date: Tue, 29 Sep 2026 20:22:27 +1000 Subject: [PATCH] feat(aws-integration-setup): grant events:DescribeEventBus and lambda:GetFunctionCodeSigningConfig Two CSPM rules read fields only these calls return: the event bus KMS key and a function's code signing config. Without them the rules cannot tell configured from unconfigured and are withheld as not evaluated. Both calls return configuration metadata only. Co-Authored-By: Claude Opus 5.5 --- .../cloudformation/nullify-cloudformation-template.json | 2 ++ .../terraform-v6/modules/nullify-aws-integration/data.tf | 2 ++ .../terraform/modules/nullify-aws-integration/data.tf | 2 ++ 3 files changed, 6 insertions(+) diff --git a/aws-integration-setup/cloudformation/nullify-cloudformation-template.json b/aws-integration-setup/cloudformation/nullify-cloudformation-template.json index 8d241bd..3158289 100644 --- a/aws-integration-setup/cloudformation/nullify-cloudformation-template.json +++ b/aws-integration-setup/cloudformation/nullify-cloudformation-template.json @@ -494,6 +494,7 @@ "elasticmapreduce:List*", "es:Describe*", "es:List*", + "events:DescribeEventBus", "events:List*", "globalaccelerator:List*", "glue:GetCrawlers", @@ -557,6 +558,7 @@ "kms:GetKeyRotationStatus", "kms:List*", "lambda:GetFunction", + "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunctionUrlConfig", "lambda:GetPolicy", "lambda:List*", diff --git a/aws-integration-setup/terraform-v6/modules/nullify-aws-integration/data.tf b/aws-integration-setup/terraform-v6/modules/nullify-aws-integration/data.tf index efc29a5..83f73c2 100644 --- a/aws-integration-setup/terraform-v6/modules/nullify-aws-integration/data.tf +++ b/aws-integration-setup/terraform-v6/modules/nullify-aws-integration/data.tf @@ -140,6 +140,7 @@ data "aws_iam_policy_document" "readonly_policy_part1" { "elasticmapreduce:List*", "es:Describe*", "es:List*", + "events:DescribeEventBus", "events:List*", "globalaccelerator:List*", "glue:GetCrawlers", @@ -191,6 +192,7 @@ data "aws_iam_policy_document" "readonly_policy_part2" { "kms:GetKeyRotationStatus", "kms:List*", "lambda:GetFunction", + "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunctionUrlConfig", "lambda:GetPolicy", "lambda:List*", diff --git a/aws-integration-setup/terraform/modules/nullify-aws-integration/data.tf b/aws-integration-setup/terraform/modules/nullify-aws-integration/data.tf index 12ff65f..5fc3e2d 100644 --- a/aws-integration-setup/terraform/modules/nullify-aws-integration/data.tf +++ b/aws-integration-setup/terraform/modules/nullify-aws-integration/data.tf @@ -164,6 +164,7 @@ data "aws_iam_policy_document" "readonly_policy_part1" { "elasticmapreduce:List*", "es:Describe*", "es:List*", + "events:DescribeEventBus", "events:List*", "globalaccelerator:List*", "glue:GetCrawlers", @@ -215,6 +216,7 @@ data "aws_iam_policy_document" "readonly_policy_part2" { "kms:GetKeyRotationStatus", "kms:List*", "lambda:GetFunction", + "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunctionUrlConfig", "lambda:GetPolicy", "lambda:List*",