Adding additional orgs permissions (#13)

Co-authored-by: Miki Padhiary <[email protected]>
aws-cloudformation · Sep 7, 2023 · cf4caba · cf4caba
1 parent acce8ce
commit cf4caba
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/aws-controltower-enabledcontrol/aws-controltower-enabledcontrol.json b/aws-controltower-enabledcontrol/aws-controltower-enabledcontrol.json
@@ -28,7 +28,13 @@
         "controltower:ListEnabledControls",
         "controltower:GetControlOperation",
         "controltower:EnableControl",
-        "organizations:UpdatePolicy"
+        "organizations:UpdatePolicy",
+        "organizations:CreatePolicy",
+        "organizations:AttachPolicy",
+        "organizations:DetachPolicy",
+        "organizations:ListPoliciesForTarget",
+        "organizations:ListTargetsForPolicy",
+        "organizations:DescribePolicy"
       ]
     },
     "delete": {

diff --git a/aws-controltower-enabledcontrol/resource-role.yaml b/aws-controltower-enabledcontrol/resource-role.yaml
@@ -35,6 +35,12 @@ Resources:
                 - "controltower:GetControlOperation"
                 - "controltower:ListEnabledControls"
                 - "organizations:UpdatePolicy"
+                - "organizations:CreatePolicy"
+                - "organizations:AttachPolicy"
+                - "organizations:DetachPolicy"
+                - "organizations:ListPoliciesForTarget"
+                - "organizations:ListTargetsForPolicy"
+                - "organizations:DescribePolicy"
                 Resource: "*"
 Outputs:
   ExecutionRoleArn: