diff --git a/terraform/aws/analytical-platform-data-production/tooling-iam/tooling-integration-iam-policies.tf b/terraform/aws/analytical-platform-data-production/tooling-iam/tooling-integration-iam-policies.tf index 6cca2dc5bb..4b763cde91 100644 --- a/terraform/aws/analytical-platform-data-production/tooling-iam/tooling-integration-iam-policies.tf +++ b/terraform/aws/analytical-platform-data-production/tooling-iam/tooling-integration-iam-policies.tf @@ -72,6 +72,60 @@ resource "aws_iam_policy" "bedrock_integration" { policy = data.aws_iam_policy_document.bedrock_integration.json } +#tfsec:ignore:aws-iam-no-policy-wildcards +data "aws_iam_policy_document" "textract_integration" { + #checkov:skip=CKV_AWS_111: This is a service policy + #checkov:skip=CKV_AWS_356: Needs to access multiple resources + statement { + sid = "AnalyticalPlatformTextractIntegration" + effect = "Allow" + + actions = [ + "textract:AnalyzeDocument", + "textract:DetectDocumentText", + "textract:GetDocumentAnalysis", + "textract:GetLendingAnalysis", + "textract:ListAdapterVersions", + "textract:AnalyzeExpense", + "textract:GetAdapter", + "textract:GetDocumentTextDetection", + "textract:GetLendingAnalysisSummary", + "textract:ListTagsForResource", + "textract:AnalyzeID", + "textract:GetAdapterVersion", + "textract:GetExpenseAnalysis", + "textract:ListAdapters", + "textract:CreateAdapter", + "textract:DeleteAdapterVersion", + "textract:StartExpenseAnalysis", + "textract:CreateAdapterResource", + "textract:StartDocumentAnalysis", + "textract:StartLendingAnalysis", + "textract:DeleteAdapter", + "textract:StartDocumentTextDetection", + "textract:UpdateAdapter", + "textract:TagResource", + "textract:UntagResource", + ] + + resources = ["*"] + condition { + test = "StringEquals" + variable = "aws:RequestedRegion" + values = [ + "eu-west-1", + "eu-west-2", + ] + } + } +} + +resource "aws_iam_policy" "textract_integration" { + name = "analytical-platform-textract-integration" + description = "Permissions needed to allow access to Textract from tooling." + policy = data.aws_iam_policy_document.textract_integration.json +} + #trivy:ignore:aws-iam-no-policy-wildcards data "aws_iam_policy_document" "quicksight_author" { #checkov:skip=CKV_AWS_111: This is a service policy