enha: limited CloudWatch permission scope

Kilian · Kilian · commit ae8734f90ae1 · 2024-03-23T14:12:24.000+01:00
diff --git a/main.tf b/main.tf
@@ -77,7 +77,7 @@ data "aws_iam_policy_document" "log" {
       "logs:PutLogEvents"
     ]
 
-    resources = ["*"]
+    resources = [aws_cloudwatch_log_group.main[0].arn, "${aws_cloudwatch_log_group.main[0].arn}/*"]
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -77,7 +77,7 @@ data "aws_iam_policy_document" "log" {`
`77`	`77`	`"logs:PutLogEvents"`
`78`	`78`	`]`
`79`	`79`
`80`		`- resources = ["*"]`
	`80`	`+ resources = [aws_cloudwatch_log_group.main[0].arn, "${aws_cloudwatch_log_group.main[0].arn}/*"]`
`81`	`81`	`}`
`82`	`82`	`}`
`83`	`83`