actually let Actions invalidate

beggers · Mar 4, 2024 · 4b64910 · 4b64910
1 parent db1c6c0
commit 4b64910
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/terraform/cloudfront.tf b/terraform/cloudfront.tf
@@ -59,6 +59,13 @@ data "aws_iam_policy_document" "invalidate_cloudfront_cache" {
       "cloudfront:CreateInvalidation",
     ]
     effect = "Allow"
+    condition {
+      test     = "ArnLike"
+      variable = "aws:SourceArn"
+      values = [
+        aws_iam_role.github_actions.arn
+      ]
+    }
     resources = [
       aws_cloudfront_distribution.main.arn
     ]