From aeefc7d4df017264dfd743f3c5eaac5eb4b993db Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Thu, 5 Nov 2026 19:42:56 +0100 Subject: [PATCH] test(iam): pin log-group scope for DescribeMetricFilters and db for DeregisterDBProxyTargets Follow-up to #1782 (CodeRabbit review threads). Refs #157 DescribeMetricFilters lists the log-group resource type in the SAR (servicereference logs.json), so the monitoring test now requires it on both the Lambda and ECS log groups instead of treating it as action-only. rds:DeregisterDBProxyTargets gains "db" in requiredRDSProxyTypes. servicereference rds.json lists cluster, db, proxy and target-group without required markers and the SAR HTML page did not render, so db being required is unverified; it is kept because db is required for RegisterDBProxyTargets and is the deregistered target. Co-Authored-By: Claude Opus 5.5 --- .../aws/ci-cd-permissions/monitoring_apply_test.go | 7 ++++--- .../environments/aws/ci-cd-permissions/rds_scopes_test.go | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go b/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go index 430716a2b..7adca1557 100644 --- a/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go +++ b/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go @@ -33,10 +33,11 @@ func TestDeployPolicyGrantsEveryActionTheMonitoringModuleNeeds(t *testing.T) { add(alarm, "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:TagResource") // The migration alarm's filter is on the Lambda log group; the monitoring // module's filters are on the Lambda and ECS groups. - add(lambdaLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter") - add(ecsLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter") + // DescribeMetricFilters lists the log-group resource type in the SAR. + add(lambdaLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter", "logs:DescribeMetricFilters") + add(ecsLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter", "logs:DescribeMetricFilters") // No resource-level permissions for these. - for _, a := range []string{"logs:DescribeMetricFilters", "logs:PutQueryDefinition", "logs:DescribeQueryDefinitions", "logs:DeleteQueryDefinition"} { + for _, a := range []string{"logs:PutQueryDefinition", "logs:DescribeQueryDefinitions", "logs:DeleteQueryDefinition"} { needs = append(needs, grantNeed{action: a, noResource: true}) } assertGranted(t, "monitoring", needs) diff --git a/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go b/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go index 2fb153fd1..10e20005d 100644 --- a/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go +++ b/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go @@ -123,7 +123,7 @@ var requiredRDSProxyTypes = map[string][]string{ "rds:DeleteDBProxy": {"db-proxy"}, "rds:ModifyDBProxy": {"db-proxy"}, "rds:RegisterDBProxyTargets": {"db", "target-group"}, - "rds:DeregisterDBProxyTargets": {"db-proxy", "target-group"}, + "rds:DeregisterDBProxyTargets": {"db", "db-proxy", "target-group"}, "rds:ModifyDBProxyTargetGroup": {"target-group"}, }