Restrict permissions on aws_iam_policy_document (#23)

* restrict permissions on runtask action * fix typo
cn-terraform · Nov 17, 2022 · d3f46b0 · d3f46b0
1 parent a57b8db
commit d3f46b0
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/main.tf b/main.tf
@@ -17,6 +17,11 @@ data "aws_iam_policy_document" "scheduled_task_cw_event_role_cloudwatch_policy"
     effect    = "Allow"
     actions   = ["ecs:RunTask"]
     resources = ["*"]
+    condition {
+      test     = "ArnEquals"
+      variable = "ecs:cluster"
+      values   = [var.ecs_cluster_arn]
+    }
   }
   statement {
     actions   = ["iam:PassRole"]