Fix inline policy

Rashair · Jun 15, 2020 · 1067d8a · 1067d8a
1 parent 90c6a50
commit 1067d8a
Showing 1 changed file with 19 additions and 28 deletions.
diff --git a/serverless-template.yml b/serverless-template.yml
@@ -32,9 +32,25 @@
                 "Role": null,
                 "Policies": [
                     "AWSLambdaFullAccess",
-                    "AmazonS3FullAccess",
-                    {"Ref": "DecryptAwsSecretPolicy"},
-                    "AmazonRDSFullAccess"
+                    "AmazonS3FullAccess", {
+                        "Version": "2012-10-17",
+                        "Statement": [{
+                                "Effect": "Allow",
+                                "Action": [
+                                    "secretsmanager:GetSecretValue",
+                                    "kms:Decrypt"
+                                ],
+                                "Resource": [
+                                    "arn:aws:secretsmanager:*:*:secret:*",
+                                    "arn:aws:kms:*:*:key/*",
+                                ]
+                            }, {
+                                "Effect": "Allow",
+                                "Action": "kms:ListKeys",
+                                "Resource": "*"
+                            }
+                        ]
+                    }
                 ],
                 "Environment": {
                     "Variables": {
@@ -66,31 +82,6 @@
             },
             "DependsOn": "SecretRDSInstanceAttachment"
         },
-        "DecryptAwsSecretPolicy": {
-            "Type": "AWS::IAM::Policy",
-            "Properties": {
-                "PolicyDocument": {
-                    "Version": "2012-10-17",
-                    "Statement": [{
-                            "Effect": "Allow",
-                            "Action": [
-                                "secretsmanager:GetSecretValue",
-                                "kms:Decrypt"
-                            ],
-                            "Resource": [
-                                "arn:aws:secretsmanager:*:*:secret:*",
-                                "*"
-                            ]
-                        }, {
-                            "Effect": "Allow",
-                            "Action": "kms:ListKeys",
-                            "Resource": "*"
-                        }
-                    ]
-                },
-                "PolicyName": "DecryptSecretPolicy",
-            }
-        },
         "s3staticcontenthrpotter": {
             "Type": "AWS::S3::Bucket",
             "Properties": {