[sdlf-cicd] lambda:TagResource for event-source-mapping in team role

awslabs · Sep 24, 2024 · 1e88ad6 · 1e88ad6
1 parent 7e8fdce
commit 1e88ad6
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/sdlf-cicd/template-cicd-domain-team-role.yaml b/sdlf-cicd/template-cicd-domain-team-role.yaml
@@ -318,7 +318,9 @@ Resources:
               - lambda:UpdateFunctionCode
               - lambda:AddPermission
               - lambda:RemovePermission
-            Resource: !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
+            Resource:
+              - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:sdlf-${pTeamName}-*
+              - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:event-source-mapping:* # for lambda:TagResource
           - Effect: Allow
             Action:
               - states:ListActivities # W13 exception