update apigateway permission

lacework · Dec 13, 2023 · 3c376a7 · 3c376a7
1 parent 0a010bc
commit 3c376a7
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 15 deletions.
diff --git a/README.md b/README.md
@@ -101,8 +101,7 @@ The audit policy is comprised of the following permissions:
 | SSO                        | sso:DescribeAccountAssignmentDeletionStatus             | *         |
 |                            | sso:DescribeInstanceAccessControlAttributeConfiguration |           |
 |                            | sso:GetInlinePolicyForPermissionSet                     |           |
-| APIGATEWAY                 | apigateway:GET                                          | *         |
-| APIGATEWAYV2               | apigatewayv2:GET                                        | *         |
+| APIGATEWAY                 | apigateway:GET                                          | arn:aws:apigateway:*::/apikeys/*         |      |
 | WAFREGIONAL                | waf-regional:ListRules                                  | *         |
 |                            | waf-regional:GetRule                                    |           |
 |                            | waf-regional:ListRuleGroups                             |           |

diff --git a/main.tf b/main.tf
@@ -94,14 +94,9 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
   statement {
     sid = "APIGATEWAY"
     actions = ["apigateway:GET"]
-    resources = ["*"]
+    resources = ["arn:aws:apigateway:*::/apikeys/*"]
   }
 
-  statement {
-    sid = "APIGATEWAYV2"
-    actions = ["apigatewayv2:GET"]
-    resources = ["*"]
-  }
   statement {
     sid = "WAFREGIONAL"
     actions = ["waf-regional:ListRules",
@@ -120,17 +115,18 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
   }
 
   statement {
-    sid = "SNS"
-    actions = ["sns:GetDataProtectionPolicy",
-      "sns:ListPlatformApplications",
-      "sns:GetSubscriptionAttributes",
+    sid = "CODEBUILD"
+    actions = ["codebuild:ListBuilds",
+      "codebuild:BatchGetBuilds",
     ]
     resources = ["*"]
   }
+
   statement {
-    sid = "CODEBUILD"
-    actions = ["codebuild:ListBuilds",
-      "codebuild:BatchGetBuilds",
+    sid = "SNS"
+    actions = ["sns:GetDataProtectionPolicy",
+      "sns:ListPlatformApplications",
+      "sns:GetSubscriptionAttributes",
     ]
     resources = ["*"]
   }