CCM-12858: more restrictive rule

nhsd-angel-pastor · nhsd-angel-pastor · commit 69b14b718263 · 2026-01-16T17:00:15.000Z
diff --git a/infrastructure/terraform/components/dl/module_sqs_core_notifier.tf b/infrastructure/terraform/components/dl/module_sqs_core_notifier.tf
@@ -38,7 +38,7 @@ data "aws_iam_policy_document" "sqs_inbound_event" {
     condition {
       test     = "ArnLike"
       variable = "aws:SourceArn"
-      values   = ["arn:aws:events:${var.region}:${var.aws_account_id}:rule/${local.csi}/*"]
+      values   = [ aws_cloudwatch_event_rule.pdm_resource_available.arn ]
     }
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,7 @@ data "aws_iam_policy_document" "sqs_inbound_event" {`
`38`	`38`	`condition {`
`39`	`39`	`test = "ArnLike"`
`40`	`40`	`variable = "aws:SourceArn"`
`41`		`- values = ["arn:aws:events:${var.region}:${var.aws_account_id}:rule/${local.csi}/*"]`
	`41`	`+ values = [ aws_cloudwatch_event_rule.pdm_resource_available.arn ]`
`42`	`42`	`}`
`43`	`43`	`}`
`44`	`44`	`}`