generated from ministryofjustice/cloud-platform-terraform-template
-
Notifications
You must be signed in to change notification settings - Fork 2
/
cognito-idp.tf
33 lines (31 loc) · 861 Bytes
/
cognito-idp.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
data "aws_iam_policy_document" "cognito_idp_for_github" {
statement {
sid = "AllowCognitoList"
effect = "Allow"
actions = [
"cognito-idp:ListUserPools",
"cognito-idp:DescribeUserPoolDomain"
]
resources = ["*"]
}
statement {
sid = "AllowCognitoGetOwn"
effect = "Allow"
actions = [
"cognito-idp:List*",
"cognito-idp:Describe*",
"cognito-idp:Get*",
"wafv2:GetWebACLForResource",
"SNS:GetSMSSandboxAccountStatus"
]
resources = [
"arn:aws:cognito-idp:*:${data.aws_caller_identity.current.account_id}:userpool/*",
"arn:aws:wafv2:*:${data.aws_caller_identity.current.account_id}:*/webacl/*/*"
]
condition {
test = "StringLike"
variable = "aws:PrincipalTag/GithubTeam"
values = ["*:$${aws:ResourceTag/GithubTeam}:*"]
}
}
}