Updated fleet-manager policy (#6013)

ministryofjustice · Jan 17, 2024 · 5258ad2 · 5258ad2
1 parent cb19b1f
commit 5258ad2
Showing 1 changed file with 4 additions and 10 deletions.
diff --git a/terraform/environments/bootstrap/delegate-access/policies.tf b/terraform/environments/bootstrap/delegate-access/policies.tf
@@ -824,17 +824,11 @@ data "aws_iam_policy_document" "fleet-manager-document" {
     effect = "Allow"
     actions = [
       "ssm:DescribeSessions",
+      "ec2:DescribeTags",
       "ec2:DescribeInstances",
-      "ec2:DescribeTags"
-    ]
-    resources = ["*"]
-  }
-  statement {
-    sid    = "FleetManagerDeny"
-    effect = "Deny"
-    actions = [
-      "ssm:StartSession",
-      "ssm:ResumeSession"
+      "ssm-guiconnect:StartConnection",
+      "ssm-guiconnect:GetConnection",
+      "ssm:StartSession"
     ]
     resources = ["*"]
   }