Membership decision includes 'approved' field. Only trigger athenz sync on approval

1 files changed, 1 insertions, 1 deletions

diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/AthenzAccessControlService.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/AthenzAccessControlService.java
index 9a6a661d7e0..2e4f3f16218 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/AthenzAccessControlService.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/integration/athenz/AthenzAccessControlService.java
@@ -92,7 +92,7 @@ public class AthenzAccessControlService implements AccessControlService {
                     var reason = roleInformation.getPendingRequest().get().getReason();
 
                     zms.decidePendingRoleMembership(role, vespaTeam, expiry, Optional.of(reason), Optional.of(oAuthCredentials), approve);
-                    athenzInstanceSynchronizer.synchronizeInstances(tenantName);
+                    if (approve) athenzInstanceSynchronizer.synchronizeInstances(tenantName);
                     return true;
                 }
         ).orElseThrow(() -> new UnsupportedOperationException("Only allowed in systems running Vespa Athenz instance"));