Merge branch 'main' into chore/use-standalone-task-definition

aws-ia · May 28, 2024 · f86e27f · f86e27f
2 parents 0b1e32d + 5c2b302
commit f86e27f
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 11 deletions.
diff --git a/terraform/fargate-examples/queue-processing/main.tf b/terraform/fargate-examples/queue-processing/main.tf
@@ -38,7 +38,8 @@ module "ecs_service" {
 
   container_definitions = {
     (local.container_name) = {
-      image = module.ecr.repository_url
+      image                    = module.ecr.repository_url
+      readonly_root_filesystem = false
     }
   }
 
@@ -340,16 +341,9 @@ data "aws_iam_policy_document" "lambda_role" {
   }
 
   statement {
-    sid = "SQSReadWrite"
+    sid = "SQSReadAttributes"
     actions = [
-      "sqs:ChangeMessageVisibility",
-      "sqs:ChangeMessageVisibilityBatch",
-      "sqs:SendMessage",
-      "sqs:DeleteMessage",
-      "sqs:DeleteMessageBatch",
-      "sqs:GetQueueAttributes",
-      "sqs:GetQueueUrl",
-      "sqs:ReceiveMessage"
+      "sqs:GetQueueAttributes"
     ]
     resources = [module.sqs.queue_arn]
   }

diff --git a/terraform/fargate-examples/vpc-endpoints/main.tf b/terraform/fargate-examples/vpc-endpoints/main.tf
@@ -42,7 +42,7 @@ module "vpc_endpoints" {
       }
     }
     },
-    { for service in toset(["ecr.api", "ecr.dkr", "ecs", "ecs-telemetry", "ecs-agent", "logs", "ssm", "secretsmanager"]) :
+    { for service in toset(["ecr.api", "ecr.dkr", "ecs", "ecs-telemetry", "ecs-agent", "sqs", "logs", "ssm", "secretsmanager"]) :
       replace(service, ".", "_") =>
       {
         service             = service