add secretsmanager:GetRandomPassword (#303)

* add * reduce two kms disable actions to wildcard Disable* * fixed * sort
mattclay · May 29, 2024 · 418bbb7 · 418bbb7
1 parent 60716b7
commit 418bbb7
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/aws/policy/security-services.yaml b/aws/policy/security-services.yaml
@@ -73,8 +73,7 @@ Statement:
       - kms:CreateGrant
       - kms:DeleteAlias
       - kms:Describe*
-      - kms:DisableKey
-      - kms:DisableKeyRotation
+      - kms:Disable*
       - kms:EnableKey
       - kms:EnableKeyRotation
       - kms:Get*
@@ -88,6 +87,7 @@ Statement:
       - kms:UpdateKeyDescription
       - logs:List*
       - secretsmanager:Describe*
+      - secretsmanager:GetRandomPassword
       - secretsmanager:List*
     Resource: "*"