Fixed permission samples

[skip actions]
imperva · Jun 18, 2024 · 8a1a25d · 8a1a25d
1 parent 57453ea
commit 8a1a25d
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 12 deletions.
diff --git a/permissions_samples/aws/OnboardMssqlRdsWithDataPermissions.txt b/permissions_samples/aws/OnboardMssqlRdsWithDataPermissions.txt
@@ -82,6 +82,7 @@
             "Action": [
                 "logs:DescribeLogGroups",
                 "logs:ListTagsLogGroup",
+                "logs:ListTagsForResource",
                 "logs:PutRetentionPolicy"
             ],
             "Resource": "*"
@@ -204,6 +205,26 @@
                 "s3:DeleteBucket",
                 "s3:DeleteObject",
                 "s3:CreateBucket",
+                "s3:PutObject",
+                "s3:PutObjectAcl",
+                "s3:PutBucketTagging",
+                "s3:PutObjectTagging",
+                "s3:PutObjectVersionTagging",
+                "s3:DeleteAccessPoint",
+                "s3:DeleteObjectVersion",
+                "s3:CreateAccessPoint",
+                "s3:PutBucketPublicAccessBlock",
+                "s3:PutAccountPublicAccessBlock"
+            ],
+            "Resource": [
+                "arn:aws:s3:::imperva-dsf-*",
+                "arn:aws:s3:::imperva-dsf-*/*"
+            ]
+        },
+        {
+            "Sid": "s3GeneralPermissions",
+            "Effect": "Allow",
+            "Action": [
                 "s3:ListBucket",
                 "s3:ListAllMyBuckets",
                 "s3:ListBucketVersions",
@@ -219,29 +240,21 @@
                 "s3:GetReplicationConfiguration",
                 "s3:GetEncryptionConfiguration",
                 "s3:GetBucketObjectLockConfiguration",
-                "s3:PutObject",
-                "s3:PutObjectAcl",
-                "s3:PutBucketTagging",
-                "s3:PutObjectTagging",
-                "s3:PutObjectVersionTagging",
                 "s3:GetObject",
                 "s3:GetBucketAcl",
                 "s3:GetObjectAcl",
                 "s3:GetBucketLocation",
                 "s3:GetBucketTagging",
                 "s3:GetObjectTagging",
                 "s3:GetAccountPublicAccessBlock",
-                "s3:GetBucketPublicAccessBlock",
-                "s3:DeleteAccessPoint",
-                "s3:DeleteObjectVersion",
-                "s3:CreateAccessPoint",
-                "s3:PutBucketPublicAccessBlock",
-                "s3:PutAccountPublicAccessBlock"
+                "s3:GetBucketPublicAccessBlock"
             ],
             "Resource": [
+                "arn:aws:s3:::ae309159-115c-4504-b0c2-03dd022f3368",
+                "arn:aws:s3:::ae309159-115c-4504-b0c2-03dd022f3368/*",
                 "arn:aws:s3:::imperva-dsf-*",
                 "arn:aws:s3:::imperva-dsf-*/*"
             ]
         }
     ]
-}
+}
diff --git a/permissions_samples/aws/OnboardMysqlRdsPermissions.txt b/permissions_samples/aws/OnboardMysqlRdsPermissions.txt
@@ -74,6 +74,7 @@
             "Action": [
                 "logs:DescribeLogGroups",
                 "logs:ListTagsLogGroup",
+                "logs:ListTagsForResource",
                 "logs:PutRetentionPolicy"
             ],
             "Resource": "*"

diff --git a/permissions_samples/aws/OnboardPostgreSqlRdsPermissions.txt b/permissions_samples/aws/OnboardPostgreSqlRdsPermissions.txt
@@ -75,6 +75,7 @@
             "Action": [
                 "logs:DescribeLogGroups",
                 "logs:ListTagsLogGroup",
+                "logs:ListTagsForResource",
                 "logs:PutRetentionPolicy"
             ],
             "Resource": "*"