rebase with policy changes

nhsconnect · Dec 13, 2024 · c3bbb71 · c3bbb71
1 parent 9d236c2
commit c3bbb71
Showing 1 changed file with 11 additions and 9 deletions.
diff --git a/infrastructure/lambda-delete-doc-object.tf b/infrastructure/lambda-delete-doc-object.tf
@@ -42,15 +42,17 @@ module "delete-document-object-lambda" {
   name           = "DeleteDocumentObjectS3"
   handler        = "handlers.delete_document_object_handler.lambda_handler"
   lambda_timeout = 900
-  iam_role_policies = [
-    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
-    "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
-    module.ndr-app-config.app_config_policy_arn,
-    module.ndr-document-store.s3_object_access_policy,
-    module.ndr-lloyd-george-store.s3_object_access_policy,
-    module.document_reference_dynamodb_table.dynamodb_policy,
-    module.lloyd_george_reference_dynamodb_table.dynamodb_policy,
-    aws_iam_policy.dynamodb_stream_delete_object_policy.arn
+  iam_role_policy_documents = [
+    module.document_reference_dynamodb_table.dynamodb_read_policy_document,
+    module.document_reference_dynamodb_table.dynamodb_write_policy_document,
+    module.ndr-document-store.s3_read_policy_document,
+    module.ndr-document-store.s3_write_policy_document,
+    module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
+    module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
+    module.ndr-lloyd-george-store.s3_read_policy_document,
+    module.ndr-lloyd-george-store.s3_write_policy_document,
+    module.ndr-app-config.app_config_policy,
+    aws_iam_policy.dynamodb_stream_delete_object_policy.policy
   ]
   rest_api_id       = null
   api_execution_arn = null