feat: Update IAM policy document to limit ECR permissions (DBTP-3170) - #1546
feat: Update IAM policy document to limit ECR permissions (DBTP-3170)#1546BenFielder wants to merge 3 commits into
Conversation
Dependency Review✅ No vulnerabilities or OpenSSF Scorecard issues found.Scanned FilesNone |
|
Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run |
| test = "StringLike" | ||
| variable = "aws:PrincipalArn" | ||
| values = [ | ||
| "arn:aws:iam::${id}:role/aws-reserved/sso.amazonaws.com/eu-west-2/AWSReservedSSO_AdministratorAccess_*", |
There was a problem hiding this comment.
I assume we are fine allowing admins to have access under some circumstances where for some reason they may need to manually upload an image? Unlikely, but probably worth keeping the access there.
| resources = "*" | ||
| } | ||
|
|
||
| statement { |
There was a problem hiding this comment.
Will this statement get ignored, since another action adds the same permissions below.
3 participants
Addresses https://uktrade.atlassian.net/browse/DBTP-3170.
Updating the IAM policy for ECR repositories to tighten the permissions to further restrict who can push and pull from them.
Checklist:
Title:
feat: Add new feature (DBTP-1234)orchore: Correct typo (off-ticket)Description:
Tasks:
Reviewer Checklist