Fixes #457 - instead of 'support:*' specify the exact permissions we …

…need
jantman · Sep 21, 2020 · b1e8db5 · b1e8db5
1 parent e90d2a1
commit b1e8db5
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 2 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -10,6 +10,7 @@ Unreleased Changes
 * `Issue #477 <https://github.com/jantman/awslimitchecker/issues/477>`__ - For all VPC resources that support the ``owner-id`` filter, supply that filter when describing them, set to the current account ID. This will prevent shared resources from other accounts from being counted against the limits.
 * `Issue #475 <https://github.com/jantman/awslimitchecker/issues/475>`__ - When an Alert Provider is used, only exit non-zero if an exception is encountered. Exit zero even if there are warnings and/or criticals.
 * `Issue #467 <https://github.com/jantman/awslimitchecker/issues/467>`__ - Fix the Service Quotas quota name for VPC "NAT Gateways per AZ" limit.
+* `Issue #457 <https://github.com/jantman/awslimitchecker/issues/457>`__ - In the required IAM permissions, replace ``support:*`` with the specific permissions that we need.
 
 .. _changelog.8_1_0:
 

diff --git a/awslimitchecker/checker.py b/awslimitchecker/checker.py
@@ -649,7 +649,11 @@ def get_required_iam_policy(self):
         """
         required_actions = [
             'servicequotas:ListServiceQuotas',
-            'support:*',
+            'support:DescribeTrustedAdvisorCheckRefreshStatuses',
+            'support:DescribeTrustedAdvisorCheckResult',
+            'support:DescribeTrustedAdvisorCheckSummaries',
+            'support:DescribeTrustedAdvisorChecks',
+            'support:RefreshTrustedAdvisorCheck',
             'sts:GetCallerIdentity',
             'trustedadvisor:Describe*',
             'trustedadvisor:RefreshCheck'

diff --git a/awslimitchecker/tests/test_checker.py b/awslimitchecker/tests/test_checker.py
@@ -852,7 +852,11 @@ def test_get_required_iam_policy(self):
                     'foo:perm2',
                     'servicequotas:ListServiceQuotas',
                     'sts:GetCallerIdentity',
-                    'support:*',
+                    'support:DescribeTrustedAdvisorCheckRefreshStatuses',
+                    'support:DescribeTrustedAdvisorCheckResult',
+                    'support:DescribeTrustedAdvisorCheckSummaries',
+                    'support:DescribeTrustedAdvisorChecks',
+                    'support:RefreshTrustedAdvisorCheck',
                     'trustedadvisor:Describe*',
                     'trustedadvisor:RefreshCheck'
                 ],