feat: add permission for cognito-idp service (#114)

ljohnny-git · web-flow · commit fb67991f6a20 · 2024-12-04T15:29:55.000-08:00
Signed-off-by: ljohnny &lt;ljohnny@fortinet.com&gt;
diff --git a/README.md b/README.md
@@ -163,4 +163,8 @@ The audit policy is comprised of the following permissions:
 |                            | backup:DescribeProtectedResource                        |           |
 |                            | backup:ListRecoveryPointsByResource                     |           |
 |                            | backup:ListReportPlans                                  |           |
-|                            | backup:ListRestoreJobs                                  |           |
+|                            | backup:ListRestoreJobs                                  |           |
+| COGNITO-IDP                | cognito-idp:GetSigningCertificate                       |           |
+|                            | cognito-idp:GetCSVHeader                                |           |
+|                            | cognito-idp:GetUserPoolMfaConfig                        |           |
+|                            | cognito-idp:GetUICustomization                          |           |
diff --git a/main.tf b/main.tf
@@ -211,6 +211,16 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
     ]
     resources = ["*"]
   }
+
+  statement {
+    sid = "COGNITOIDP"
+    actions = ["cognito-idp:GetSigningCertificate",
+      "cognito-idp:GetCSVHeader",
+      "cognito-idp:GetUserPoolMfaConfig",
+      "cognito-idp:GetUICustomization",
+    ]
+    resources = ["*"]
+  }
 }
 
 resource "aws_iam_policy" "lacework_audit_policy" {

Original file line number	Diff line number	Diff line change
`@@ -211,6 +211,16 @@ data "aws_iam_policy_document" "lacework_audit_policy" {`
`211`	`211`	`]`
`212`	`212`	`resources = ["*"]`
`213`	`213`	`}`
	`214`	`+`
	`215`	`+ statement {`
	`216`	`+ sid = "COGNITOIDP"`
	`217`	`+ actions = ["cognito-idp:GetSigningCertificate",`
	`218`	`+ "cognito-idp:GetCSVHeader",`
	`219`	`+ "cognito-idp:GetUserPoolMfaConfig",`
	`220`	`+ "cognito-idp:GetUICustomization",`
	`221`	`+ ]`
	`222`	`+ resources = ["*"]`
	`223`	`+ }`
`214`	`224`	`}`
`215`	`225`
`216`	`226`	`resource "aws_iam_policy" "lacework_audit_policy" {`