From b7bce72a18b36624c94f76b7ac5e7ed5d61f3827 Mon Sep 17 00:00:00 2001
From: Ahmed Khan <a.manzoor743@gmail.com>
Date: Tue, 16 Jul 2024 13:51:40 +0500
Subject: [PATCH] RCOR-1992: updated inventory permissions for aws rekognition

---
 RapticoreCrossAccountStack.json                |  9 +++++++++
 RapticoreCrossAccountStack.yaml                | 10 ++++++++--
 freemium/IAMRoleFreemiumCrossAccountStack.yaml |  6 ++++++
 rapticore_extractor_addon.json                 |  9 +++++++++
 4 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/RapticoreCrossAccountStack.json b/RapticoreCrossAccountStack.json
index 9ac2d46..ffb39df 100644
--- a/RapticoreCrossAccountStack.json
+++ b/RapticoreCrossAccountStack.json
@@ -418,6 +418,15 @@
                   ],
                   "Resource": "*",
                   "Sid": "AllowMediaReadOnly"
+                },
+                {
+                  "Action": [
+                    "rekognition:DescribeDataset",
+                    "rekognition:DescribeProjects"
+                  ],
+                  "Resource": "*",
+                  "Effect": "Allow",
+                  "Sid": "AllowRekognitionReadOnly"
                 }
               ],
               "Version": "2012-10-17"
diff --git a/RapticoreCrossAccountStack.yaml b/RapticoreCrossAccountStack.yaml
index d8ffd59..427413c 100644
--- a/RapticoreCrossAccountStack.yaml
+++ b/RapticoreCrossAccountStack.yaml
@@ -319,8 +319,14 @@ Resources:
                   - geo:DescribeRouteCalculator
                   - geo:DescribeGeofenceCollection
                   - geo:DescribeTracker
-                Resource: '*'
+                Resource: "*"
                 Sid: AllowLocationServiceReadOnly
+              - Effect: Allow
+                Action:
+                  - rekognition:DescribeDataset
+                  - rekognition:DescribeProjects
+                Resource: "*"
+                Sid: AllowRekognitionReadOnly
               - Effect: Allow
                 Action:
                   - medialive:DescribeChannel
@@ -334,7 +340,7 @@ Resources:
                   - mediaconvert:ListJobs
                   - mediaconvert:DescribeEndpoints
                   - mediaconvert:GetPolicy
-                Resource: '*'
+                Resource: "*"
                 Sid: AllowMediaReadOnly
 
             Version: "2012-10-17"
diff --git a/freemium/IAMRoleFreemiumCrossAccountStack.yaml b/freemium/IAMRoleFreemiumCrossAccountStack.yaml
index 0e9e919..9f1fb7e 100644
--- a/freemium/IAMRoleFreemiumCrossAccountStack.yaml
+++ b/freemium/IAMRoleFreemiumCrossAccountStack.yaml
@@ -331,6 +331,12 @@ Resources:
                   - mediaconvert:GetPolicy
                 Resource: '*'
                 Sid: AllowMediaReadOnly
+              - Effect: Allow
+                Action:
+                  - rekognition:DescribeDataset
+                  - rekognition:DescribeProjects
+                Resource: "*"
+                Sid: AllowRekognitionReadOnly
 
             Version: "2012-10-17"
           PolicyName: RapticoreExtendedViewOnly
diff --git a/rapticore_extractor_addon.json b/rapticore_extractor_addon.json
index 3e36108..e9fe087 100644
--- a/rapticore_extractor_addon.json
+++ b/rapticore_extractor_addon.json
@@ -359,6 +359,15 @@
       ],
       "Resource": "*",
       "Sid": "AllowMediaReadOnly"
+    },
+    {
+      "Action": [
+        "rekognition:DescribeDataset",
+        "rekognition:DescribeProjects"
+      ],
+      "Resource": "*",
+      "Effect": "Allow",
+      "Sid": "AllowRekognitionReadOnly"
     }
   ],
   "Version": "2012-10-17"