permissionForSNS

lacework · Dec 13, 2023 · c6675c7 · c6675c7
1 parent b868fe3
commit c6675c7
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -145,3 +145,6 @@ The audit policy is comprised of the following permissions:
 |                            | glue:GetTags                                            |           |
 | CODEBUILD                  | codebuild:ListBuilds                                    | *         |
 |                            | codebuild:BatchGetBuilds                                |           |
+| SNS                        | sns:GetDataProtectionPolicy                             | *         |
+|                            | sns:ListPlatformApplications                            |           |
+|                            | sns:GetSubscriptionAttributes                           |           |
diff --git a/main.tf b/main.tf
@@ -158,6 +158,15 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
     ]
     resources = ["*"]
   }
+
+  statement {
+    sid = "SNS"
+    actions = ["sns:GetDataProtectionPolicy",
+      "sns:ListPlatformApplications",
+      "sns:GetSubscriptionAttributes",
+    ]
+    resources = ["*"]
+  }
 }
 
 resource "aws_iam_policy" "lacework_audit_policy" {