Merge pull request #1818 from alphagov/sengi/powerusers-only-change-o…

…wn-keys

`poweruser` roles should only allow rotating the user's own keys.

terraform/projects/infra-security/main.tf

@@ -260,9 +260,7 @@ data "aws_iam_policy_document" "allow-iam-key-rotation" {
       "iam:ListAccessKeys",
       "iam:UpdateAccessKey",
     ]
-
-    effect    = "Allow"
-    resources = ["*"]
+    resources = ["arn:aws:iam::*:user/&{aws:username}"]
   }
 }