fix: limit permissions

draios · Feb 16, 2024 · 707278f · 707278f
1 parent 706d2e2
commit 707278f
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 9 deletions.
diff --git a/modules/services/workload-scanning/main.tf b/modules/services/workload-scanning/main.tf
@@ -31,11 +31,7 @@ data "aws_iam_policy_document" "scanning" {
       "ecr:GetDownloadUrlForLayer",
       "ecr:BatchGetImage",
       "ecr:BatchCheckLayerAvailability",
-      "ecr:GetRepositoryPolicy",
-      "ecr:DescribeRepositories",
       "ecr:ListImages",
-      "ecr:DescribeImages",
-      "ecr:ListTagsForResource",
       "ecr:GetAuthorizationToken",
     ]
 
@@ -49,7 +45,7 @@ resource "aws_iam_policy" "scanning" {
   count = (var.deploy_global_resources || var.is_organizational) ? 1 : 0
 
   name        = var.name
-  description = "Grants Sysdig Secure access to volumes and snapshots"
+  description = "Grants Sysdig Secure access to ECR images"
   policy      = data.aws_iam_policy_document.scanning[0].json
   tags        = var.tags
 }

diff --git a/modules/services/workload-scanning/organizational.tf b/modules/services/workload-scanning/organizational.tf
@@ -67,11 +67,7 @@ Resources:
                     - "ecr:GetDownloadUrlForLayer"
                     - "ecr:BatchGetImage"
                     - "ecr:BatchCheckLayerAvailability"
-                    - "ecr:GetRepositoryPolicy"
-                    - "ecr:DescribeRepositories"
                     - "ecr:ListImages"
-                    - "ecr:DescribeImages"
-                    - "ecr:ListTagsForResource"
                     - "ecr:GetAuthorizationToken"
                   Resource: "*"