Add `cloudwatch:TagResource` permission to ProvisionAssessment policy - Githubissues

cisagov / cool-assessment-terraform

Terraform to deploy an assessment environment to the COOL

Creative Commons Zero v1.0 Universal

13 stars 4 forks source link

Add `cloudwatch:TagResource` permission to ProvisionAssessment policy #245

Closed dav3r closed 3 months ago

dav3r commented 3 months ago

🗣 Description

This PR adds the cloudwatch:TagResource permission to the "ProvisionAssessment" policy.

💭 Motivation and context

Previously, this permission was not necessary, but it is now needed to successfully create CloudWatch alarms.

Without this change, we were seeing errors like this:

│ Error: creating CloudWatch Metric Alarm (ec2_cpu_utilization_i-1234567890abcdef): AccessDenied:
User: arn:aws:sts::123456789012:assumed-role/ProvisionAccount/admin is not authorized to perform:
cloudwatch:TagResource on resource:
arn:aws:cloudwatch:us-east-1:123456789012:alarm:ec2_cpu_utilization_i-1234567890abcdef
because no identity-based policy allows the cloudwatch:TagResource action

Thanks @adevine31 for bringing this to my attention! 👍

🧪 Testing

@adevine31 confirmed that he was able to successfully apply the Terraform in this repository using the changes in this PR.

✅ Pre-approval checklist

[x] This PR has an informative and human-readable title.
[x] Changes are limited to a single goal - eschew scope creep!
[x] All relevant type-of-change labels have been added.
[x] I have read the CONTRIBUTING document.
[x] These code changes follow cisagov code standards.
[x] All new and existing tests pass.