Allow CodePipeline, SNS, and Organizations to Untag too

**Why?** When changing an organization wide tag, it would fail to update the stack due to this missing permission..
awslabs · Jun 8, 2023 · 58f6ab9 · 58f6ab9
1 parent 5402a97
commit 58f6ab9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/...base/initial_commit/bootstrap_repository/adf-bootstrap/deployment/pipeline_management.yml b/...base/initial_commit/bootstrap_repository/adf-bootstrap/deployment/pipeline_management.yml
@@ -796,6 +796,7 @@ Resources:
                   - "codepipeline:RegisterWebhookWithThirdParty"
                   - "codepipeline:StartPipelineExecution"
                   - "codepipeline:TagResource"
+                  - "codepipeline:UntagResource"
                   - "codepipeline:UpdatePipeline"
                 Resource:
                   - !Sub arn:${AWS::Partition}:codepipeline:${AWS::Region}:${AWS::AccountId}:webhook:adf-webhook-*
@@ -817,6 +818,7 @@ Resources:
                   - "sns:SetTopicAttributes"
                   - "sns:GetTopicAttributes"
                   - "sns:TagResource"
+                  - "sns:UntagResource"
                   - "sns:ListSubscriptionsByTopic"
                 Resource:
                   - !Sub arn:${AWS::Partition}:sns:${AWS::Region}:${AWS::AccountId}:${PipelinePrefix}*

diff --git a/src/template.yml b/src/template.yml
@@ -402,6 +402,7 @@ Resources:
               - Effect: Allow
                 Action:
                   - "organizations:TagResource"
+                  - "organizations:UntagResource"
                 Resource: "*"
 
   AccountTagConfigFunction: