fix(modules): volume access add KMS management permissions

sysdiglabs · Sep 10, 2024 · 6b35bb1 · 6b35bb1
1 parent 2edb270
commit 6b35bb1
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/modules/volume_access.cft.yaml b/modules/volume_access.cft.yaml
@@ -255,7 +255,8 @@ Resources:
                   Effect: "Allow"
                   Principal:
                     AWS:
-                    - !Sub "arn:aws:iam::${AWS::AccountId}:root"
+                    - !Sub arn:aws:iam::${AWS::AccountId}:root
+                    - !Sub arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-stackset-execution-${NameSuffix}
                   Action: "kms:*"
                   Resource: "*"
           ScanningKmsAlias:
@@ -449,8 +450,8 @@ Resources:
                   Effect: "Allow"
                   Principal:
                     AWS:
-                    - !Sub arn:aws:iam::${ScanningAccountID}:root
-                    - !Sub arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-${NameSuffix}
+                    - !Sub "arn:aws:iam::${ScanningAccountID}:root"
+                    - !Sub "arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-${NameSuffix}"
                   Action:
                   - "kms:Encrypt"
                   - "kms:Decrypt"
@@ -465,6 +466,7 @@ Resources:
                   Principal:
                     AWS:
                     - !Sub "arn:aws:iam::${AWS::AccountId}:root"
+                    - !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgMember"
                   Action: "kms:*"
                   Resource: "*"
           ScanningKmsAlias: