From 2a3e350d106e3dc392848d59a2319e3b089fff98 Mon Sep 17 00:00:00 2001 From: Daniel Sotirhos Date: Tue, 9 Apr 2024 16:06:18 -0700 Subject: [PATCH] Fix: Alarm api_unauthorized for HeadBucket/Object from SSM agent (#6141) --- terraform/gitlab/gitlab.tf.json.template.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/terraform/gitlab/gitlab.tf.json.template.py b/terraform/gitlab/gitlab.tf.json.template.py index 116dc6518d..1e25e5ec88 100644 --- a/terraform/gitlab/gitlab.tf.json.template.py +++ b/terraform/gitlab/gitlab.tf.json.template.py @@ -345,7 +345,10 @@ def qq(*words): 'edu-ucsc-gi-azul-*', '*.azul.data.humancellatlas.org', ] - ) + ) + [ + f'amazon-ssm-packages-{aws.region_name}', + f'aws-ssm-document-attachments-{aws.region_name}' + ] ) }, @@ -949,7 +952,9 @@ def qq(*words): 's3:HeadObject' ], 'resources': [ + f'arn:aws:s3:::amazon-ssm-packages-{aws.region_name}', f'arn:aws:s3:::amazon-ssm-packages-{aws.region_name}/*', + f'arn:aws:s3:::aws-ssm-document-attachments-{aws.region_name}', f'arn:aws:s3:::aws-ssm-document-attachments-{aws.region_name}/*' ] }