From f8a1ef0e36b9cf0a1585056945f6e384c388eaa9 Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Wed, 8 Jul 2026 16:31:04 -0400
Subject: [PATCH] change from username to jbid for principalTag

---
 policies/sc-dbuser/policy.tf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/policies/sc-dbuser/policy.tf b/policies/sc-dbuser/policy.tf
index b605dc7..3bb0219 100644
--- a/policies/sc-dbuser/policy.tf
+++ b/policies/sc-dbuser/policy.tf
@@ -23,7 +23,7 @@ data "aws_iam_policy_document" "inline" {
     # Can't embed dbuser here — PI scopes to the DB resource, not user — leave or separate
     resources = [format("arn:%v:%v:*:*:%v", data.aws_arn.current.partition, "pi", "metrics/rds/*")]
   }
-  # Deny rds-db:connect if the session tag UserName is not present (i.e. not authenticated via SSO or STS)
+  # Deny rds-db:connect if the session tag jbid is not present (i.e. not authenticated via SSO or STS)
   statement {
     sid    = "DenyRDSConnectIfNoTag"
     effect = "Deny"
@@ -31,18 +31,18 @@ data "aws_iam_policy_document" "inline" {
     resources = ["*"]
     condition {
       test     = "Null"
-      variable = "aws:PrincipalTag/UserName"
+      variable = "aws:PrincipalTag/jbid"
       values   = ["true"]
     }
   }
-  # Allow rds-db:connect if the session tag UserName matches the DB username in the resource ARN
+  # Allow rds-db:connect if the session tag jbid matches the DB jbid in the resource ARN
   statement {
     sid    = "AllowRDSConnectSelf"
     effect = "Allow"
     actions = ["rds-db:connect"]
     resources = [
-      # Scopes to only the DB username matching their session tag
-      format("arn:%v:%v:*:*:%v:*/$${aws:PrincipalTag/UserName}", data.aws_arn.current.partition, "rds-db", "dbuser")
+      # Scopes to only the DB jbid matching their session tag
+      format("arn:%v:%v:*:*:%v:*/$${aws:PrincipalTag/jbid}", data.aws_arn.current.partition, "rds-db", "dbuser")
     ]
   }
 }