Update permission boundary to include deny on attaching policies to B…

…CGOV managed roles
BCDevOps · Nov 14, 2024 · 6d6a5d1 · 6d6a5d1
1 parent f7189c7
commit 6d6a5d1
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/modules/account-sso/main.tf b/modules/account-sso/main.tf
@@ -82,6 +82,7 @@ resource "aws_iam_policy" "bcgov_perm_boundary" {
           "iam:Delete*",
           "iam:DetachRolePolicy",
           "iam:DeleteRolePolicy",
+          "iam:AttachRolePolicy",
           "iam:DeleteUserPermissionsBoundary",
           "iam:PutUserPermissionsBoundary",
           "iam:DeleteRolePermissionsBoundary"