Remove permission that already exist in v48 security audit policy (#126)

lacework · Jan 16, 2025 · 109ff6c · 109ff6c
1 parent a40e918
commit 109ff6c
Showing 1 changed file with 4 additions and 15 deletions.
diff --git a/main.tf b/main.tf
@@ -50,13 +50,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
 
   statement {
     sid = "EFS"
-    actions = ["elasticfilesystem:DescribeFileSystemPolicy",
-      "elasticfilesystem:DescribeLifecycleConfiguration",
-      "elasticfilesystem:DescribeAccessPoints",
-      "elasticfilesystem:DescribeAccountPreferences",
-      "elasticfilesystem:DescribeBackupPolicy",
-      "elasticfilesystem:ListTagsForResource",
-    "elasticfilesystem:DescribeReplicationConfigurations"]
+    actions = ["elasticfilesystem:ListTagsForResource"]
     resources = ["*"]
   }
 
@@ -78,12 +72,8 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
   statement {
     sid = "IDENTITYSTORE"
     actions = ["identitystore:DescribeGroup",
-      "identitystore:DescribeGroupMembership",
-      "identitystore:DescribeUser",
-      "identitystore:ListGroupMemberships",
-      "identitystore:ListGroupMembershipsForMember",
-      "identitystore:ListGroups",
-    "identitystore:ListUsers"]
+    "identitystore:DescribeGroupMembership",
+    "identitystore:DescribeUser"]
     resources = ["*"]
   }
 
@@ -129,8 +119,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
     sid = "GLUE"
     actions = ["glue:ListWorkflows",
       "glue:BatchGetWorkflows",
-      "glue:GetWorkflow",
-      "glue:GetTags"]
+      "glue:GetWorkflow"]
     resources = ["*"]
   }