reduce to postgres usecase requirements only

terraform-modules · Apr 7, 2026 · 1e6b2cc · 1e6b2cc
1 parent 6087693
commit 1e6b2cc
Showing 1 changed file with 0 additions and 70 deletions.
diff --git a/policies/sc-dbuser/policy.tf b/policies/sc-dbuser/policy.tf
@@ -1,56 +1,4 @@
 data "aws_iam_policy_document" "inline" {
-  statement {
-    sid       = "AllowEC2Read"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "ec2:Describe*",
-      "ec2:Get*",
-      "ec2:List*",
-    ]
-  }
-  statement {
-    sid       = "AllowKMSList"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "kms:Describe*",
-      "kms:List*",
-    ]
-  }
-  statement {
-    sid       = "RDSKMSDefaultKeyAccess"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "kms:Decrypt",
-      "kms:EnableK*",
-      "kms:Encrypt",
-      "kms:GenerateDataKey*",
-      "kms:ReEncrypt*",
-    ]
-    condition {
-      test     = "StringEquals"
-      variable = "kms:ResourceAliases"
-      values = [
-        "alias/aws/rds",
-        "alias/aws/secretsmanager"
-      ]
-    }
-  }
-  statement {
-    sid       = "RestrictInfKMS"
-    effect    = "Deny"
-    resources = ["*"]
-    actions   = ["kms:*"]
-    condition {
-      test     = "StringLike"
-      variable = "kms:RequestAlias"
-      values = [
-        "alias/k-kms-inf*"
-      ]
-    }
-  }
   statement {
     sid       = "AllowRDSDB"
     effect    = "Allow"
@@ -67,22 +15,4 @@ data "aws_iam_policy_document" "inline" {
       "pi:ListAvailableResourceMetrics"
     ]
   }
-  statement {
-    sid       = "AllowSecretsManagerList"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "secretsmanager:List*",
-    ]
-  }
-  statement {
-    sid       = "AllowSecretsManagerRead"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "secretsmanager:BatchGetSecretValue",
-      "secretsmanager:DescribeSecret",
-      "secretsmanager:GetSecretValue",
-    ]
-  }
 }