Limit access to destination to accounts in our org

ServerlessOpsIO · Aug 18, 2024 · 68d3559 · 68d3559
1 parent 5c084d4
commit 68d3559
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/stacksets/datadog-shipping/logs-template.yaml b/stacksets/datadog-shipping/logs-template.yaml
@@ -168,7 +168,12 @@ Resources:
               "AWS": "logs.amazonaws.com"
             },
             "Action": "logs:PutSubscriptionFilter",
-            "Resource": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:destination:DATADOG-LOGS-FIREHOSE"
+            "Resource": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:destination:DATADOG-LOGS-FIREHOSE",
+            "Condition": {
+              "StringEquals": {
+                "aws:PrincipalOrgID": !Ref AwsOrgId
+               }
+            }
           }
         ]
       }'