Updates SNS topic LandingZone-IAMActivity's policy so it only allows …

…publishing from the core-mangement account and adds policy to prevent error "loading the SNS subscriptions for topics" when viewing corresponding active CloudWatch alarms Signed-off-by: Stefan Wessels Beljaars <[email protected]>
schubergphilis · Jan 2, 2024 · b269707 · b269707
1 parent 2c97ba7
commit b269707
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 3 deletions.
diff --git a/files/sns/iam_activity_topic_policy.json.tpl b/files/sns/iam_activity_topic_policy.json.tpl
@@ -21,17 +21,31 @@
       "Resource": "${sns_topic}",
       "Condition": {
         "StringEquals": {
-          "AWS:SourceOwner": "${account_id}"
+          "AWS:SourceOwner": "${audit_account_id}"
         }
       }
     },
     {
-      "Sid": "__services_allowed_publish",
+      "Sid": "AllowServicesToPublishFromMgmtAccount",
       "Effect": "Allow",
       "Principal": {
         "Service": ${services_allowed_publish}
       },
       "Action": "sns:Publish",
+      "Resource": "${sns_topic}",
+      "Condition": {
+        "StringEquals": {
+          "AWS:SourceAccount": "${mgmt_account_id}"
+        }
+      }
+    },
+    {
+      "Sid": "AllowMgmtMasterToListSubcriptions",
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::${mgmt_account_id}:root"
+      },
+      "Action": "sns:ListSubscriptionsByTopic",
       "Resource": "${sns_topic}"
     }
     %{ if length(security_hub_roles) > 0 ~}

diff --git a/iam_activity_logging.tf b/iam_activity_logging.tf
@@ -16,7 +16,8 @@ resource "aws_sns_topic_policy" "iam_activity" {
   arn = aws_sns_topic.iam_activity[0].arn
 
   policy = templatefile("${path.module}/files/sns/iam_activity_topic_policy.json.tpl", {
-    account_id               = data.aws_caller_identity.audit.account_id
+    audit_account_id         = data.aws_caller_identity.audit.account_id
+    mgmt_account_id          = data.aws_caller_identity.management.account_id
     services_allowed_publish = jsonencode("cloudwatch.amazonaws.com")
     sns_topic                = aws_sns_topic.iam_activity[0].arn