fix: correct permissions for write (#5)

* fix: correct permissions for write

* ci: fix checkov wanring on actions

Author: nathanhruby

.github/workflows/pre-commit.yml

@@ -9,6 +9,8 @@ on:
 env:
   TERRAFORM_DOCS_VERSION: v0.16.0
 
+permissions: read-all
+
 jobs:
   collectInputs:
     name: Collect workflow inputs

.github/workflows/semantic-releaser.yml

@@ -8,6 +8,8 @@ on:
       - '**.tf'
       - '!examples/**.tf'
 
+permissions: read-all
+
 jobs:
   release:
     name: Release

main.tf

@@ -91,7 +91,7 @@ data "aws_iam_policy_document" "bucket" {
       "s3:PutObject",
     ]
 
-    resources = [for o in var.account_trails : "${local.bucket_arn}/AWSLogs/${o.account}"]
+    resources = [for o in var.account_trails : "${local.bucket_arn}/AWSLogs/${o.account}/*"]
 
     condition {
       test     = "StringEquals"