Merge pull request #9 from terraform-modules/svc-cat-deny

add deny product updates to sc-servicecatalog t1 and t2
terraform-modules · May 28, 2026 · 7d2c84f · 7d2c84f
2 parents 178d304 + adaf5b7
commit 7d2c84f
Show file tree

Hide file tree

Showing 4 changed files with 22 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -98,3 +98,6 @@
   - group-assignment
     - add validation that the provided account_names actuall exist within the organization
 
+* 1.8.1 -- 2026-05-28
+  - updated policies/sc-servicecatalog-t1,-t2
+    - deny update to provisioned products and properties of provisioned products
diff --git a/common/version.tf b/common/version.tf
@@ -1,3 +1,3 @@
 locals {
-  _module_version = "1.8.0"
+  _module_version = "1.8.1"
 }
diff --git a/policies/sc-servicecatalog-t1/policy.tf b/policies/sc-servicecatalog-t1/policy.tf
@@ -10,4 +10,13 @@ data "aws_iam_policy_document" "inline" {
     ]
     resources = ["*"]
   }
+  statement {
+    sid    = "DenyProductUpdates"
+    effect = "Deny"
+    actions = [
+      "servicecatalog:UpdateProvisionedProduct",
+      "servicecatalog:UpdateProvisionedProductProperties",
+    ]
+    resources = ["*"]
+   }
 }
diff --git a/policies/sc-servicecatalog-t2/policy.tf b/policies/sc-servicecatalog-t2/policy.tf
@@ -31,5 +31,14 @@ data "aws_iam_policy_document" "inline" {
     ]
     resources = ["*"]
   }
+  statement {
+    sid    = "DenyProductUpdates"
+    effect = "Deny"
+    actions = [
+      "servicecatalog:UpdateProvisionedProduct",
+      "servicecatalog:UpdateProvisionedProductProperties",
+    ]
+    resources = ["*"]
+   }
 }