Merge pull request #37 from SPHTech-Platform/chore/decouple-perms

decouple addPermissions

Author: hong-yi

data.tf

@@ -23,7 +23,6 @@ data "aws_iam_policy_document" "update_lambda" {
     sid = "LambdaUpdateEvent"
 
     actions = [
-      "lambda:AddPermission",
       "lambda:UpdateFunctionCode",
       "lambda:UpdateFunctionConfiguration",
       "lambda:UpdateAlias",
@@ -46,6 +45,17 @@ data "aws_iam_policy_document" "update_lambda" {
       resources = ["arn:aws:apigateway:${data.aws_region.current.name}::/restapis/${var.apigw_id}/*"]
     }
   }
+
+  dynamic "statement" {
+    for_each = var.enable_version_identifier ? [1] : []
+    content {
+      sid = "AllowLambdaAddPermissions"
+      actions = [
+        "lambda:AddPermission",
+      ]
+      resources = ["arn:aws:lambda:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:function:${var.function_prefix}*"]
+    }
+  }
 }
 
 data "aws_iam_policy_document" "update_lambda_combined" {