Updates SNS topic LandingZone-IAMActivity's policy so it only allows …

…publishing from the core-mangement account and adds policy to prevent error "loading the SNS subscriptions for topics" when viewing corresponding active CloudWatch alarms

Signed-off-by: Stefan Wessels Beljaars <[email protected]>

files/sns/iam_activity_topic_policy.json.tpl

@@ -21,18 +21,32 @@
       "Resource": "${sns_topic}",
       "Condition": {
         "StringEquals": {
-          "AWS:SourceOwner": "${account_id}"
+          "AWS:SourceOwner": "${audit_account_id}"
         }
       }
     },
     {
-      "Sid": "__services_allowed_publish",
+      "Sid": "AllowServicesToPublishFromMgmtAccount",
       "Effect": "Allow",
       "Principal": {
         "Service": ${services_allowed_publish}
       },
       "Action": "sns:Publish",
-      "Resource": "${sns_topic}"
+      "Resource": "${sns_topic}",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${mgmt_account_id}"
+        }
+      }
+    },
+    {
+      "Sid": "AllowMgmtMasterToListSubcriptions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::${mgmt_account_id}:root"
+      },
+      "Action": "sns:ListSubscriptionsByTopic",
+      "Resource": "arn:aws:sns:eu-west-1:${audit_account_id}:LandingZone-IAMActivity"
     }
     %{ if length(security_hub_roles) > 0 ~}
     ,

iam_activity_logging.tf

@@ -16,7 +16,8 @@ resource "aws_sns_topic_policy" "iam_activity" {
   arn = aws_sns_topic.iam_activity[0].arn
 
   policy = templatefile("${path.module}/files/sns/iam_activity_topic_policy.json.tpl", {
-    account_id               = data.aws_caller_identity.audit.account_id
+    audit_account_id         = data.aws_caller_identity.audit.account_id
+    mgmt_account_id          = data.aws_caller_identity.management.account_id
     services_allowed_publish = jsonencode("cloudwatch.amazonaws.com")
     sns_topic                = aws_sns_topic.iam_activity[0].arn