diff --git a/terragrunt/org_account/iam_identity_center/platform_forms_assignments.tf b/terragrunt/org_account/iam_identity_center/platform_forms_assignments.tf index 6733561c..9b076287 100644 --- a/terragrunt/org_account/iam_identity_center/platform_forms_assignments.tf +++ b/terragrunt/org_account/iam_identity_center/platform_forms_assignments.tf @@ -12,6 +12,10 @@ locals { group = aws_identitystore_group.forms_production_athena_query_access, permission_set = aws_ssoadmin_permission_set.athena_query_access, }, + { + group = aws_identitystore_group.forms_production_billing_read_only, + permission_set = aws_ssoadmin_permission_set.read_only_billing, + }, { group = aws_identitystore_group.forms_production_rds_query_access, permission_set = aws_ssoadmin_permission_set.rds_query_access, @@ -35,6 +39,10 @@ locals { group = aws_identitystore_group.forms_staging_athena_query_access, permission_set = aws_ssoadmin_permission_set.athena_query_access, }, + { + group = aws_identitystore_group.forms_staging_billing_read_only, + permission_set = aws_ssoadmin_permission_set.read_only_billing, + }, { group = aws_identitystore_group.forms_staging_rds_query_access, permission_set = aws_ssoadmin_permission_set.rds_query_access, diff --git a/terragrunt/org_account/iam_identity_center/platform_forms_groups.tf b/terragrunt/org_account/iam_identity_center/platform_forms_groups.tf index 31d3ff4b..fcf922ce 100644 --- a/terragrunt/org_account/iam_identity_center/platform_forms_groups.tf +++ b/terragrunt/org_account/iam_identity_center/platform_forms_groups.tf @@ -13,6 +13,12 @@ resource "aws_identitystore_group" "forms_production_athena_query_access" { identity_store_id = local.sso_identity_store_id } +resource "aws_identitystore_group" "forms_production_billing_read_only" { + display_name = "Forms-Production-Billing-ReadOnly" + description = "Grants members read-only Billing and Cost Explorer access to the Forms Production account." + identity_store_id = local.sso_identity_store_id +} + resource "aws_identitystore_group" "forms_production_rds_query_access" { display_name = "Forms-Production-RDS-Query-Access" description = "Grants members access to the RDS query editor in the GC Forms Production account." @@ -40,6 +46,12 @@ resource "aws_identitystore_group" "forms_staging_athena_query_access" { identity_store_id = local.sso_identity_store_id } +resource "aws_identitystore_group" "forms_staging_billing_read_only" { + display_name = "Forms-Staging-Billing-ReadOnly" + description = "Grants members read-only Billing and Cost Explorer access to the Forms Staging account." + identity_store_id = local.sso_identity_store_id +} + resource "aws_identitystore_group" "forms_staging_rds_query_access" { display_name = "Forms-Staging-RDS-Query-Access" description = "Grants members access to the RDS query editor in the GC Forms Staging account."