Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
lambda_permissions.tf
################################################################################
# AWS Lambda IAM Policy document definitions
################################################################################
data "aws_iam_policy_document" "this" {
statement {
effect = "Allow"
actions = [
"s3:GetBucketLocation",
"s3:ListAllMyBuckets",
]
resources = [
"*",
]
}
statement {
effect = "Allow"
actions = [
"s3:Get*",
"s3:List*",
"s3:Describe*",
"s3:RestoreObject",
]
resources = [
"*",
]
}
# Required if Lambda is created inside VPC
statement {
effect = "Allow"
actions = [
"ec2:DescribeNetworkInterfaces",
"ec2:CreateNetworkInterface",
"ec2:DeleteNetworkInterface",
]
resources = [
"*",
]
}
# Required if lambda requires specific Secrets from AWS SSM
statement {
effect = "Allow"
actions = [
"ssm:GetParameter",
]
resources = [
"${aws_ssm_parameter.redshift_lambda_db_password.arn}",
]
}
# Required if using encrypted data
statement {
effect = "Allow"
actions = [
"kms:ListKeys",
"kms:Encrypt",
"kms:Decrypt",
]
resources = [
"*",
]
}
statement {
effect = "Allow"
actions = [
"sns:Publish",
]
resources = [
"${aws_sns_topic.lambda_sns_dql.arn}",
]
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.