Merge pull request #8415 from ministryofjustice/feature/7907-add-cond…

…ition-to-passrole Add condition to `modernisation-platform-oidc-cicd` `iam:PassRole` permission
ministryofjustice · Nov 6, 2024 · fdff945 · fdff945
2 parents 4fb653a + 6659899
commit fdff945
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/terraform/environments/bootstrap/member-bootstrap/iam.tf b/terraform/environments/bootstrap/member-bootstrap/iam.tf
@@ -567,6 +567,11 @@ data "aws_iam_policy_document" "policy" {
     actions   = ["iam:PassRole"]
     effect    = "Allow"
     resources = ["*"]
+    condition {
+      test     = "StringEquals"
+      values   = ["ssm.amazonaws.com"]
+      variable = "iam:PassedToService"
+    }
   }
 
   statement {