fix: add ssm:GetParameters permission to lambda IAM policies

thomasnemer · thomasnemer · commit 6e95a5b789bc · 2026-03-10T12:06:43.000+01:00
diff --git a/modules/runners/job-retry/policies/lambda.json b/modules/runners/job-retry/policies/lambda.json
@@ -4,7 +4,8 @@
     {
       "Effect": "Allow",
       "Action": [
-        "ssm:GetParameter"
+        "ssm:GetParameter",
+        "ssm:GetParameters"
       ],
       "Resource": [
         "${github_app_key_base64_arn}",
diff --git a/modules/runners/policies/lambda-scale-down.json b/modules/runners/policies/lambda-scale-down.json
@@ -46,7 +46,8 @@
     {
       "Effect": "Allow",
       "Action": [
-        "ssm:GetParameter"
+        "ssm:GetParameter",
+        "ssm:GetParameters"
       ],
       "Resource": [
         "${github_app_key_base64_arn}",
diff --git a/modules/runners/policies/lambda-scale-up.json b/modules/runners/policies/lambda-scale-up.json
@@ -30,7 +30,8 @@
         {
             "Effect": "Allow",
             "Action": [
-                "ssm:GetParameter"
+                "ssm:GetParameter",
+                "ssm:GetParameters"
             ],
             "Resource": [
                 "${github_app_key_base64_arn}",
diff --git a/modules/runners/pool/policies/lambda-pool.json b/modules/runners/pool/policies/lambda-pool.json
@@ -51,7 +51,8 @@
         {
             "Effect": "Allow",
             "Action": [
-                "ssm:GetParameter"
+                "ssm:GetParameter",
+                "ssm:GetParameters"
             ],
             "Resource": [
                 "${github_app_key_base64_arn}",
diff --git a/modules/webhook/policies/lambda-ssm.json b/modules/webhook/policies/lambda-ssm.json
@@ -3,7 +3,7 @@
   "Statement": [
     {
       "Effect": "Allow",
-      "Action": ["ssm:GetParameter"],
+      "Action": ["ssm:GetParameter", "ssm:GetParameters"],
       "Resource": ${resource_arns}
     }
   ]

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@`
`3`	`3`	`"Statement": [`
`4`	`4`	`{`
`5`	`5`	`"Effect": "Allow",`
`6`		`- "Action": ["ssm:GetParameter"],`
	`6`	`+ "Action": ["ssm:GetParameter", "ssm:GetParameters"],`
`7`	`7`	`"Resource": ${resource_arns}`
`8`	`8`	`}`
`9`	`9`	`]`