Limit permissions for service roles

anajmi07 · athewsey · commit 7a24dc926401 · 2025-11-05T14:40:23.000+08:00
diff --git a/infra/modules/agentcore-iam-role/bedrock-agentcore-policy.tf b/infra/modules/agentcore-iam-role/bedrock-agentcore-policy.tf
@@ -45,7 +45,9 @@ resource "aws_iam_policy" "ecr_permissions" {
         Action = [
           "ecr:GetAuthorizationToken"
         ]
-        Resource = "*"
+        Resource = [
+          "arn:aws:ecr:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"
+        ]
       }
     ]
   })
diff --git a/infra/modules/knowledge-base/main.tf b/infra/modules/knowledge-base/main.tf
@@ -8,8 +8,14 @@ resource "aws_iam_role_policy" "bedrock_kb_sample_kb_model" {
     Statement = [
       {
         Action   = [
-          "aoss:APIAccessAll",
-          "aoss:DashboardsAccessAll"
+          "aoss:CreateIndex",
+          "aoss:DescribeIndex",
+          "aoss:UpdateIndex",
+          "aoss:DeleteIndex",
+          "aoss:WriteDocument",
+          "aoss:ReadDocument",
+          "aoss:SearchDocument",
+          "aoss:DeleteDocument"
         ]
         Effect   = "Allow"
         Resource = [var.opensearch_arn]

Original file line number	Diff line number	Diff line change
`@@ -45,7 +45,9 @@ resource "aws_iam_policy" "ecr_permissions" {`
`45`	`45`	`Action = [`
`46`	`46`	`"ecr:GetAuthorizationToken"`
`47`	`47`	`]`
`48`		`- Resource = "*"`
	`48`	`+ Resource = [`
	`49`	`+ "arn:aws:ecr:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"`
	`50`	`+ ]`
`49`	`51`	`}`
`50`	`52`	`]`
`51`	`53`	`})`