CCL-497 added missing principal in strorage module (#171)

UKHomeOffice · Sep 5, 2024 · fca43e2 · fca43e2
1 parent 03d2053
commit fca43e2
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/modules/products/static-site/storage.tf b/modules/products/static-site/storage.tf
@@ -53,6 +53,12 @@ data "aws_iam_policy_document" "static_site_iam_storage_policy_document" {
     }
   }
   statement {
+    sid    = "AllowCloudFrontServicePrincipalReadOnly"
+    effect = "Allow"
+    principals {
+      type        = "Service"
+      identifiers = ["cloudfront.amazonaws.com"]
+    }
     actions = [
       "s3:ListBucket"
     ]