fix(cloudwatch-metrics-stream): add S3 permissions back to cloud_monitoring_policy

README.md

@@ -36,12 +36,20 @@ Sysdig requires AWS IAM permissions to display the correct status and metadata f
 			"Action": "ec2:DescribeInstances",
 			"Effect": "Allow",
 			"Resource": "*"
+		},
+        {
+			"Action": [
+				"s3:ListBucket",
+				"s3:ListAllMyBuckets"
+			],
+			"Effect": "Allow",
+			"Resource": "*"
 		}
 	]
 }
 ```
 
-## IAM Permissions for Sysdig Cross-Account Role - Cloudwatch Metrics Stream
+## IAM Permissions for Sysdig Cross-Account Role - Cost Advisor private billing integration
 Sysdig requires AWS IAM permissions to fetch billing data and metadata for the Private Billing integration. If `create_new_role` is set to `true`, the following IAM permissions are granted to an IAM Role..
 
 ```

modules/cloud-watch-metrics-stream/iam_data.tf

@@ -101,4 +101,14 @@ data "aws_iam_policy_document" "iam_role_task_policy_cloud_monitoring_policy" {
         ]
     }
 
+    statement {
+        effect = "Allow"
+        actions = [
+            "s3:ListAllMyBuckets",
+            "s3:ListBucket"
+        ]
+        resources = [
+            "*"
+        ]
+    }
 }