change from username to jbid for principalTag

policies/sc-dbuser/policy.tf

@@ -23,26 +23,26 @@ data "aws_iam_policy_document" "inline" {
     # Can't embed dbuser here — PI scopes to the DB resource, not user — leave or separate
     resources = [format("arn:%v:%v:*:*:%v", data.aws_arn.current.partition, "pi", "metrics/rds/*")]
   }
-  # Deny rds-db:connect if the session tag UserName is not present (i.e. not authenticated via SSO or STS)
+  # Deny rds-db:connect if the session tag jbid is not present (i.e. not authenticated via SSO or STS)
   statement {
     sid    = "DenyRDSConnectIfNoTag"
     effect = "Deny"
     actions = ["rds-db:connect"]
     resources = ["*"]
     condition {
       test     = "Null"
-      variable = "aws:PrincipalTag/UserName"
+      variable = "aws:PrincipalTag/jbid"
       values   = ["true"]
     }
   }
-  # Allow rds-db:connect if the session tag UserName matches the DB username in the resource ARN
+  # Allow rds-db:connect if the session tag jbid matches the DB jbid in the resource ARN
   statement {
     sid    = "AllowRDSConnectSelf"
     effect = "Allow"
     actions = ["rds-db:connect"]
     resources = [
-      # Scopes to only the DB username matching their session tag
-      format("arn:%v:%v:*:*:%v:*/$${aws:PrincipalTag/UserName}", data.aws_arn.current.partition, "rds-db", "dbuser")
+      # Scopes to only the DB jbid matching their session tag
+      format("arn:%v:%v:*:*:%v:*/$${aws:PrincipalTag/jbid}", data.aws_arn.current.partition, "rds-db", "dbuser")
     ]
   }
 }