test(e2e): reduce scope of e2e test permissions (#5539)

aws · Dec 4, 2023 · 3eb8d7e · 3eb8d7e
1 parent 748caa6
commit 3eb8d7e
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/tests/e2e/IntegTestResourcesStack.template.json b/tests/e2e/IntegTestResourcesStack.template.json
@@ -22,12 +22,22 @@
               "Effect": "Allow",
               "Principal": {
                 "Federated": "cognito-identity.amazonaws.com"
+              },
+              "Condition": {
+                "StringEquals": {
+                  "cognito-identity.amazonaws.com:aud": {
+                    "Ref": "IntegTestIdentityPool"
+                  }
+                },
+                "ForAnyValue:StringLike": {
+                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
+                }
               }
             }
           ],
           "Version": "2012-10-17"
         },
-        "ManagedPolicyArns": ["arn:aws:iam::aws:policy/AdministratorAccess"]
+        "ManagedPolicyArns": ["arn:aws:iam::aws:policy/AmazonCognitoReadOnly"]
       },
       "Metadata": {
         "aws:cdk:path": "IntegTestResourcesStack/IntegTestIdentityPoolUnauthRole/Resource"