add iam:ListAccountAliases for *
@@ -244,6 +244,18 @@ resource "aws_iam_policy" "policy-{{terraformize this.username}}" {
],
"Resource": "arn:aws:iam::*:mfa/{{terraformize this.username}}"
},
+ {
+ "Sid": "AllowManageOwnUserMFA",
+ "Effect": "Allow",
+ "Action": [
+ "iam:DeactivateMFADevice",
+ "iam:EnableMFADevice",
+ "iam:GetUser",
+ "iam:ListMFADevices",
+ "iam:ResyncMFADevice"
+ ],
+ "Resource": "arn:aws:iam::*:user/users/{{terraformize this.username}}"
+ },
{
"Sid": "AllowListUsers",
"Effect": "Allow",
@@ -253,16 +265,12 @@ resource "aws_iam_policy" "policy-{{terraformize this.username}}" {
"Resource": "arn:aws:iam::*:user/"
},
{
- "Sid": "AllowManageOwnUserMFA",
+ "Sid": "AllowListAccountAliases",
"Effect": "Allow",
"Action": [
- "iam:DeactivateMFADevice",
- "iam:EnableMFADevice",
- "iam:GetUser",
- "iam:ListMFADevices",
- "iam:ResyncMFADevice"
+ "iam:ListAccountAliases"
],
- "Resource": "arn:aws:iam::*:user/users/{{terraformize this.username}}"
+ "Resource": "*"
}
]
}
