feat(iam): allow cloudfront function updates

- grant CloudFront Function and invalidation permissions
2026-02-01 17:30:36 +09:00 · 2026-02-01 17:30:36 +09:00 · c31e4e36f7
commit c31e4e36f7
parent b565fb3c4b
1 changed files with 11 additions and 0 deletions
--- a/policies/cloudformation-write-policy.yaml
+++ b/policies/cloudformation-write-policy.yaml
@ -63,3 +63,14 @@ Resources:
            Action:
              - s3:PutObject
            Resource: "*"
+          - Effect: Allow
+            Action:
+              - cloudfront:CreateFunction
+              - cloudfront:UpdateFunction
+              - cloudfront:PublishFunction
+              - cloudfront:DescribeFunction
+              - cloudfront:GetFunction
+              - cloudfront:DeleteFunction
+              - cloudfront:ListFunctions
+              - cloudfront:CreateInvalidation
+            Resource: "*"