Add explicit SNS Publish permission to onboarding service for core-st…

…ack-listener. (#382) Co-authored-by: PoeppingT <[email protected]>
awslabs · Oct 28, 2022 · 0ff72aa · 0ff72aa
1 parent 98c6cb9
commit 0ff72aa
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/resources/saas-boost-svc-onboarding.yaml b/resources/saas-boost-svc-onboarding.yaml
@@ -347,7 +347,8 @@ Resources:
             Action:
               - sns:Publish
             Resource:
-              - !Sub arn:aws:sns:${AWS::Region}:${AWS::AccountId}:sb-*
+              - !Sub arn:${AWS::Partition}:sns:${AWS::Region}:${AWS::AccountId}:sb-${Environment}-onboarding*
+              - !Sub arn:${AWS::Partition}:sns:${AWS::Region}:${AWS::AccountId}:sb-${Environment}-core-stack-listener
           - Effect: Allow
             Action:
               - ssm:GetParameter*