Fix: Alarm api_unauthorized for HeadBucket from AWS Config (#6134, PR #6842)

Author: dsotirho-ucsc

terraform/shared/shared.tf.json.template.py

@@ -250,7 +250,12 @@ def conformance_pack(name: str) -> str:
                                 'Service': 'config.amazonaws.com'
                             },
                             'Action': ['s3:GetBucketAcl', 's3:ListBucket'],
-                            'Resource': '${aws_s3_bucket.aws_config.arn}'
+                            'Resource': '${aws_s3_bucket.aws_config.arn}',
+                            'Condition': {
+                                'StringEquals': {
+                                    'AWS:SourceAccount': config.aws_account_id
+                                }
+                            }
                         },
                         {
                             'Effect': 'Allow',
@@ -262,7 +267,8 @@ def conformance_pack(name: str) -> str:
                                         f'/*/AWSLogs/{config.aws_account_id}/Config/*',
                             'Condition': {
                                 'StringEquals': {
-                                    's3:x-amz-acl': 'bucket-owner-full-control'
+                                    's3:x-amz-acl': 'bucket-owner-full-control',
+                                    'AWS:SourceAccount': config.aws_account_id
                                 }
                             }
                         }