fix: Allow appropriate IDE KMS permissions for Terraform cluster crea…

…tion (aws-samples#1102)
jaradtke-aws · Sep 13, 2024 · be6a622 · be6a622
1 parent 6cbcc32
commit be6a622
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/lab/iam/policies/base.yaml b/lab/iam/policies/base.yaml
@@ -71,13 +71,14 @@ Statement:
     Resource: ["*"]
     Condition:
       StringLike:
-        kms:RequestAlias: "alias/${Env}*"
+        kms:RequestAlias: ["alias/${Env}*", "alias/eks/${Env}*"]
   - Effect: Allow
     Action:
       - kms:CreateAlias
       - kms:DeleteAlias
     Resource:
       - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/${Env}*
+      - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:alias/eks/${Env}*
       - !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*
   - Effect: Allow
     Action: