From 1e6b2ccaf3095c2fedb78deb8c1fe80a6efc0be4 Mon Sep 17 00:00:00 2001
From: "Matthew C. Morgan" <matthew.c.morgan@census.gov>
Date: Tue, 7 Apr 2026 17:00:12 -0400
Subject: [PATCH] reduce to postgres usecase requirements only

---
 policies/sc-dbuser/policy.tf | 70 ------------------------------------
 1 file changed, 70 deletions(-)

diff --git a/policies/sc-dbuser/policy.tf b/policies/sc-dbuser/policy.tf
index 8dc4ab1..1b2c448 100644
--- a/policies/sc-dbuser/policy.tf
+++ b/policies/sc-dbuser/policy.tf
@@ -1,56 +1,4 @@
 data "aws_iam_policy_document" "inline" {
-  statement {
-    sid       = "AllowEC2Read"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "ec2:Describe*",
-      "ec2:Get*",
-      "ec2:List*",
-    ]
-  }
-  statement {
-    sid       = "AllowKMSList"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "kms:Describe*",
-      "kms:List*",
-    ]
-  }
-  statement {
-    sid       = "RDSKMSDefaultKeyAccess"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "kms:Decrypt",
-      "kms:EnableK*",
-      "kms:Encrypt",
-      "kms:GenerateDataKey*",
-      "kms:ReEncrypt*",
-    ]
-    condition {
-      test     = "StringEquals"
-      variable = "kms:ResourceAliases"
-      values = [
-        "alias/aws/rds",
-        "alias/aws/secretsmanager"
-      ]
-    }
-  }
-  statement {
-    sid       = "RestrictInfKMS"
-    effect    = "Deny"
-    resources = ["*"]
-    actions   = ["kms:*"]
-    condition {
-      test     = "StringLike"
-      variable = "kms:RequestAlias"
-      values = [
-        "alias/k-kms-inf*"
-      ]
-    }
-  }
   statement {
     sid       = "AllowRDSDB"
     effect    = "Allow"
@@ -67,22 +15,4 @@ data "aws_iam_policy_document" "inline" {
       "pi:ListAvailableResourceMetrics"
     ]
   }
-  statement {
-    sid       = "AllowSecretsManagerList"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "secretsmanager:List*",
-    ]
-  }
-  statement {
-    sid       = "AllowSecretsManagerRead"
-    effect    = "Allow"
-    resources = ["*"]
-    actions = [
-      "secretsmanager:BatchGetSecretValue",
-      "secretsmanager:DescribeSecret",
-      "secretsmanager:GetSecretValue",
-    ]
-  }
 }