Update service role policy to include additional ecs, es and sqs perm…

…issions (#3423) Co-authored-by: Rob Newman <[email protected]> Co-authored-by: Sergey Fedoseev <[email protected]> Co-authored-by: Dr. Ernie Prabhakar <[email protected]> Co-authored-by: Dr. Ernie Prabhakar <[email protected]>
quiltdata · Dec 27, 2024 · 2272102 · 2272102
1 parent aa14ad8
commit 2272102
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/docs/cfn-service-role.yaml b/docs/cfn-service-role.yaml
@@ -134,6 +134,7 @@ Resources:
                   - es:CreateElasticsearchDomain
                   - es:DeleteElasticsearchDomain
                   - es:DescribeElasticsearchDomain
+                  - es:UpdateDomainConfig
                   - es:UpdateElasticsearchDomainConfig
                   - events:DeleteRule
                   - events:DescribeRule
@@ -156,6 +157,7 @@ Resources:
                   - iam:AttachRolePolicy
                   - iam:CreateInstanceProfile
                   - iam:CreatePolicy
+                  - iam:CreatePolicyVersion
                   - iam:CreateRole
                   - iam:CreateServiceLinkedRole
                   - iam:DeleteInstanceProfile
@@ -240,7 +242,7 @@ Resources:
                   - servicediscovery:GetOperation
                   - servicediscovery:GetService
                   - servicediscovery:TagResource
-                  - sns:CreateTopic*
+                  - sns:CreateTopic
                   - sns:DeleteTopic
                   - sns:Get*
                   - sns:Publish  # To publish to CFN notification topic.
@@ -250,8 +252,13 @@ Resources:
                   - sqs:CreateQueue
                   - sqs:DeleteQueue
                   - sqs:GetQueueAttributes
+                  - sqs:GetQueueUrl
+                  - sqs:ListDeadLetterSourceQueues
+                  - sqs:ListQueues
+                  - sqs:ListQueueTags
+                  - sqs:SetQueueAttributes
                   - sqs:TagQueue
-                  - ssm:AddTagsToResource 
+                  - ssm:AddTagsToResource
                   - ssm:DeleteParameter
                   - ssm:GetParameters
                   - ssm:PutParameter