Test

terraform/environments/sprinkler/iam.tf

@@ -24,6 +24,32 @@ data "aws_iam_policy_document" "oidc_deny_specific_actions" {
     }
     actions = ["sts:AssumeRole"]
   }
+
+  # checkov:skip=CKV_AWS_111: "Cannot restrict by KMS alias so leaving open"
+  # checkov:skip=CKV_AWS_356: "Cannot restrict by KMS alias so leaving open"
+  statement {
+    sid       = "AllowOIDCToDecryptKMS"
+    effect    = "Allow"
+    resources = ["*"]
+    actions   = ["kms:Decrypt"]
+  }
+
+  statement {
+    sid       = "AllowOIDCReadState"
+    effect    = "Allow"
+    resources = ["arn:aws:s3:::modernisation-platform-terraform-state/*", "arn:aws:s3:::modernisation-platform-terraform-state/"]
+    actions = ["s3:Get*",
+    "s3:List*"]
+  }
+
+  statement {
+    sid       = "AllowOIDCWriteState"
+    effect    = "Allow"
+    resources = ["arn:aws:s3:::modernisation-platform-terraform-state/environments/bootstrap/*"]
+    actions = ["s3:PutObject",
+    "s3:PutObjectAcl"]
+  }
+
   statement {
     effect = "Deny"
     actions = [