[PRM-757] Add SNS:SetSubscriptionAttributes permission to pre-prod/prod

chrisbloe · chrisbloe · commit 8d56a5d1813f · 2026-03-16T16:54:57.000Z
diff --git a/base_iam/iam_github_pre-prod.tf b/base_iam/iam_github_pre-prod.tf
@@ -166,6 +166,7 @@ resource "aws_iam_role_policy" "github_extended_policy_virus_scanner_pre_prod" {
             "ssm:CreateDocument",
             "iam:TagRole",
             "SNS:TagResource",
+            "SNS:SetSubscriptionAttributes",
             "cognito-idp:CreateUserPool",
             "cognito-idp:TagResource",
             "cognito-idp:SetUserPoolMfaConfig",
diff --git a/base_iam/iam_github_prod.tf b/base_iam/iam_github_prod.tf
@@ -270,6 +270,7 @@ resource "aws_iam_role_policy" "github_extended_policy_virus_scanner_prod" {
             "ssm:CreateDocument",
             "iam:TagRole",
             "SNS:TagResource",
+            "SNS:SetSubscriptionAttributes",
             "cognito-idp:CreateUserPool",
             "cognito-idp:TagResource",
             "cognito-idp:SetUserPoolMfaConfig",
diff --git a/infrastructure/iam_roles/pre-prod_Github-Actions-pre-prod-role.json b/infrastructure/iam_roles/pre-prod_Github-Actions-pre-prod-role.json
@@ -78,6 +78,7 @@
           "ssm:CreateDocument",
           "iam:TagRole",
           "SNS:TagResource",
+          "SNS:SetSubscriptionAttributes",
           "cognito-idp:CreateUserPool",
           "cognito-idp:TagResource",
           "cognito-idp:SetUserPoolMfaConfig",
diff --git a/infrastructure/iam_roles/prod_github-access-role.json b/infrastructure/iam_roles/prod_github-access-role.json
@@ -96,6 +96,7 @@
           "ssm:CreateDocument",
           "iam:TagRole",
           "SNS:TagResource",
+          "SNS:SetSubscriptionAttributes",
           "cognito-idp:CreateUserPool",
           "cognito-idp:TagResource",
           "cognito-idp:SetUserPoolMfaConfig",
