update domains broker to do GetServerCertificate on all IAM certifica…

…te resources in the same account (#1723)
cloud-gov · Aug 8, 2024 · e5119d8 · e5119d8
1 parent c589ddb
commit e5119d8
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/terraform/stacks/main/domains_broker.tf b/terraform/stacks/main/domains_broker.tf
@@ -418,7 +418,6 @@ resource "aws_iam_policy" "domains_broker" {
     {
       "Effect": "Allow",
       "Action": [
-        "iam:GetServerCertificate",
         "iam:UploadServerCertificate",
         "iam:DeleteServerCertificate"
       ],
@@ -429,10 +428,11 @@ resource "aws_iam_policy" "domains_broker" {
     {
       "Effect": "Allow",
       "Action": [
+        "iam:GetServerCertificate",
         "iam:ListServerCertificates"
       ],
       "Resource": [
-        "*"
+        "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:server-certificate/*"
       ]
     },
     {