Allow state role to access tags

Author: kurtismash

modules/service-deployment/iam-sfn-backup-ingest.tf

@@ -78,28 +78,6 @@ module "backup_ingest_sfn_role" {
         ],
         "Resource" : "*"
       },
-      {
-        "Sid" : "AllowGetTags",
-        "Effect" : "Allow",
-        "Action" : [
-          "backup-gateway:ListTagsForResource",
-          "dsql:ListTagsForResource",
-          "dynamodb:ListTagsOfResource",
-          "ec2:DescribeTags",
-          "elasticfilesystem:DescribeTags",
-          "fsx:ListTagsForResource",
-          "rds:ListTagsForResource",
-          "redshift-serverless:ListTagsForResource",
-          "redshift:DescribeTags",
-          "s3:GetBucketTagging",
-          "s3:GetObjectTagging",
-          "s3:GetObjectVersionTagging",
-          "ssm-sap:ListTagsForResource",
-          "storagegateway:ListTagsForResource",
-          "timestream:ListTagsForResource",
-        ],
-        "Resource" : "*"
-      },
       {
         "Sid" : "AllowBackupCopyJob",
         "Effect" : "Allow",
@@ -171,10 +149,32 @@ module "backup_ingest_sfn_state_role" {
   inline_policy = jsonencode({
     Version : "2012-10-17"
     Statement : [
+      {
+        "Sid" : "AllowGetTags",
+        "Effect" : "Allow",
+        "Action" : [
+          "backup:ListTags",
+          "backup-gateway:ListTagsForResource",
+          "dsql:ListTagsForResource",
+          "dynamodb:ListTagsOfResource",
+          "ec2:DescribeTags",
+          "elasticfilesystem:DescribeTags",
+          "fsx:ListTagsForResource",
+          "rds:ListTagsForResource",
+          "redshift-serverless:ListTagsForResource",
+          "redshift:DescribeTags",
+          "s3:GetBucketTagging",
+          "s3:GetObjectTagging",
+          "s3:GetObjectVersionTagging",
+          "ssm-sap:ListTagsForResource",
+          "storagegateway:ListTagsForResource",
+          "timestream:ListTagsForResource",
+        ],
+        "Resource" : "*"
+      },
       {
         Effect : "Allow",
         Action : [
-          "backup:ListTags",
           "backup:UpdateRecoveryPointLifecycle"
         ],
         Resource : "*"