Merge pull request #32 from liranbenabu1/main

add s3:DeleteObject permission while av_delete_infected_files equals true
trussworks · Nov 4, 2022 · 20b0df8 · 20b0df8
2 parents 4cfb1fd + 3f95ca4
commit 20b0df8
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/anti-virus-scan.tf b/anti-virus-scan.tf
@@ -29,7 +29,7 @@ data "aws_iam_policy_document" "main_scan" {
     actions = [
       "logs:CreateLogGroup",
       "logs:CreateLogStream",
-      "logs:PutLogEvents",
+      "logs:PutLogEvents"
     ]
 
     resources = ["arn:${data.aws_partition.current.partition}:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/lambda/${var.name_scan}:*"]
@@ -40,13 +40,13 @@ data "aws_iam_policy_document" "main_scan" {
 
     effect = "Allow"
 
-    actions = [
+    actions = concat([
       "s3:GetObject",
       "s3:GetObjectTagging",
       "s3:GetObjectVersion",
       "s3:PutObjectTagging",
-      "s3:PutObjectVersionTagging",
-    ]
+      "s3:PutObjectVersionTagging"
+    ],var.av_delete_infected_files ? ["s3:DeleteObject"] : [])
 
     resources = formatlist("%s/*", data.aws_s3_bucket.main_scan.*.arn)
   }