Merge pull request #8371 from ministryofjustice/feature/6170-prevent-…

…passrole-of-infrastructure-access-role Denying `iam:PassRole` of infrastructure access roles
ministryofjustice · Oct 31, 2024 · c1cb12c · c1cb12c
2 parents a7c73d6 + bd03166
commit c1cb12c
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/terraform/environments/bootstrap/member-bootstrap/iam.tf b/terraform/environments/bootstrap/member-bootstrap/iam.tf
@@ -275,6 +275,12 @@ data "aws_iam_policy_document" "member-access" {
     ]
     resources = ["arn:aws:iam::*:user/cicd-member-user"]
   }
+
+  statement {
+    actions   = ["iam:PassRole"]
+    effect    = "Deny"
+    resources = ["arn:aws:iam::*:role/MemberInfrastructureAccess"]
+  }
 }
 
 resource "aws_iam_policy" "member-access" {
@@ -390,6 +396,12 @@ data "aws_iam_policy_document" "member-access-us-east" {
     ]
     resources = ["*"]
   }
+
+  statement {
+    actions   = ["iam:PassRole"]
+    effect    = "Deny"
+    resources = ["arn:aws:iam::*:role/MemberInfrastructureAccessUSEast"]
+  }
 }
 
 resource "aws_iam_policy" "member-access-us-east" {