Skip to content

Commit

Permalink
Fix updating old global-iam stacks in the deployment account (#711)
Browse files Browse the repository at this point in the history
**Why?**

With PR #568, the policy names in the
`adf-bootstrap/deployment/example-global-iam.yml` file were updated to
ensure that they are unique. However, if the `example-global-iam.yml` was not
updated recently, then copied/renamed to `global-iam.yml` it would overwrite,
and or delete policies that were created by the `global.yml` stack instead.

This creates an issue that is hard to debug unfortunately.

**What?**

This proposed change will introduce the ADF managed policy as defined in
the `global.yml` stack of the deployment account. This way the policies are
(re)created correctly.
  • Loading branch information
sbkok committed Apr 9, 2024
1 parent 8ad242d commit 915e716
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -549,7 +549,7 @@ Resources:
CloudFormationDeploymentPolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: "adf-cloudformation-deployment-role-policy"
PolicyName: "adf-cloudformation-deployment-role-policy-kms"
PolicyDocument:
Version: "2012-10-17"
Statement:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"adf-codepipeline-role-policy-kms",
],
"adf-cloudformation-deployment-role": [
"adf-cloudformation-deployment-role-policy",
"adf-cloudformation-deployment-role-policy-kms",
],
"adf-cloudformation-role": [
"adf-cloudformation-role-policy",
Expand Down

0 comments on commit 915e716

Please sign in to comment.