Update control panel role in prod (#6661)

Updated prod control panel role to allow it to update the assume role policy for app roles
ministryofjustice · Feb 3, 2025 · b5fcc54 · b5fcc54
1 parent 25de51e
commit b5fcc54
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/terraform/aws/analytical-platform-production/cluster/iam-policies.tf b/terraform/aws/analytical-platform-production/cluster/iam-policies.tf
@@ -155,10 +155,13 @@ data "aws_iam_policy_document" "control_panel_api" {
     ]
   }
   statement {
-    sid       = "CanUpdateAssumeRolesPolicies"
-    effect    = "Allow"
-    actions   = ["iam:UpdateAssumeRolePolicy"]
-    resources = ["arn:aws:iam::${var.account_ids["analytical-platform-data-production"]}:role/${var.resource_prefix}_user_*"]
+    sid     = "CanUpdateAssumeRolesPolicies"
+    effect  = "Allow"
+    actions = ["iam:UpdateAssumeRolePolicy"]
+    resources = [
+      "arn:aws:iam::${var.account_ids["analytical-platform-data-production"]}:role/${var.resource_prefix}_user_*",
+      "arn:aws:iam::${var.account_ids["analytical-platform-data-production"]}:role/${var.resource_prefix}_app_*"
+    ]
   }
   statement {
     sid    = "CanCreateAndDeleteSSMParameters"