Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/cognito permissions #29

Merged
merged 12 commits into from
Dec 4, 2023
Merged

Feature/cognito permissions #29

Changes from 9 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
dc5027b
feat: add base cognito permissions
TheOrangePuff Nov 28, 2023
4fb99e4
remove duplicate trailing slash
Nov 29, 2023
53eb5e4
add cognito-idp:CreateUserPool against all resources
Nov 29, 2023
7657e14
allow cognito cognito-identity:CreateIdentityPool
Nov 29, 2023
956d13f
expand cognito IAM role resource boundary
Nov 29, 2023
d4cb199
allow cognito cognito-identity:SetIdentityPoolRoles
Nov 29, 2023
f24c877
allow cognito cognito-identity:SetIdentityPoolRoles - fix format
Nov 29, 2023
3280d91
mark COGNITO with its delimiter
Nov 29, 2023
7f8933e
mark COGNITO with its delimiter
Nov 29, 2023
d2e0bef
Merge branch 'main' into feature/cognito-permissions
Dec 4, 2023
1ed55ca
Merge branch 'feature/cognito-permissions' of github.com:aligent/cdk-…
Dec 4, 2023
0a4a1b0
add Cognito access instead of excessive permission
Dec 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 84 additions & 1 deletion packages/serverless-deploy-iam/bin/app.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ export class ServiceDeployIAM extends cdk.Stack {
{
name: 'IAM',
prefix: `arn:aws:iam::${accountId}:role`,
qualifiers: [`${serviceName}*`],
qualifiers: [`*${serviceName}*`],
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't seem right? 🤔 Why do we need this change?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah it was for addressing this error (Note Cognito- in the role name):

Resource handler returned message: "User: arn:aws:sts::<redacted>:assumed-role/<serviceName>-deploy-iam-ServiceRolev128EB9C79-2NHYkk36Zi32/AWSCloudFormation is not authorized to perform: iam:GetRole on resource: role Cognito-<serviceName>-stg-UnAuth because ....

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

actions: [
"iam:CreateRole",
"iam:PassRole",
Expand Down Expand Up @@ -294,6 +294,88 @@ export class ServiceDeployIAM extends cdk.Stack {
"sqs:ListDeadLetterSourceQueues",
"sqs:CreateQueue",
]
},
{
name: 'COGNITO',
prefix: `arn:aws:cognito-sync:${region}:${accountId}:identitypool`,
qualifiers: [`${serviceName}*`],
actions: [
"cognito-sync:BulkPublish",
"cognito-sync:DeleteDataset",
"cognito-sync:DescribeDataset",
"cognito-sync:DescribeIdentityPoolUsage",
"cognito-sync:DescribeIdentityUsage",
"cognito-sync:GetBulkPublishDetails",
"cognito-sync:GetCognitoEvents",
"cognito-sync:GetIdentityPoolConfiguration",
"cognito-sync:ListDatasets",
"cognito-sync:ListIdentityPoolUsage",
"cognito-sync:ListRecords",
"cognito-sync:QueryRecords",
"cognito-sync:RegisterDevice",
"cognito-sync:SetCognitoEvents",
"cognito-sync:SetDatasetConfiguration",
"cognito-sync:SetIdentityPoolConfiguration",
"cognito-sync:SubscribeToDataset",
"cognito-sync:UnsubscribeFromDataset",
"cognito-sync:UpdateRecords",
"cognito-identity:CreateIdentityPool",
"cognito-identity:DeleteIdentities",
"cognito-identity:DeleteIdentityPool",
"cognito-identity:DescribeIdentity",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:GetCredentialsForIdentity",
"cognito-identity:GetId",
"cognito-identity:GetIdentityPoolRoles",
"cognito-identity:GetOpenIdToken",
"cognito-identity:GetOpenIdTokenForDeveloperIdentity",
"cognito-identity:GetPrincipalTagAttributeMap",
"cognito-identity:ListIdentities",
"cognito-identity:ListIdentityPools",
"cognito-identity:ListTagsForResource",
"cognito-identity:LookupDeveloperIdentity",
"cognito-identity:MergeDeveloperIdentities",
"cognito-identity:SetIdentityPoolRoles",
"cognito-identity:SetPrincipalTagAttributeMap",
"cognito-identity:TagResource",
"cognito-identity:UnlinkDeveloperIdentity",
"cognito-identity:UnlinkIdentity",
"cognito-identity:UntagResource",
"cognito-identity:UpdateIdentityPool",
]
},
{
name: 'COGNITO_IDP',
prefix: `arn:aws:cognito-idp:${region}:${accountId}:userpool`,
qualifiers: [`${serviceName}*`, `${region}_*`],
actions: [
"cognito-idp:Create*",
"cognito-idp:Delete*",
"cognito-idp:Describe*",
"cognito-idp:Get*",
"cognito-idp:List*",
"cognito-idp:Set*",
"cognito-idp:TagResource",
"cognito-idp:UntagResource",
"cognito-idp:Update*",
]
},
{
name: 'COGNITO_IDP_CREATEUSERPOOL',
prefix: `arn:aws:cognito-idp:${region}:${accountId}:userpool`,
qualifiers: ["*"],
TheOrangePuff marked this conversation as resolved.
Show resolved Hide resolved
actions: [
"cognito-idp:CreateUserPool"
]
},
{
name: 'COGNITO_IDP_IDENTITYPOOL',
prefix: `arn:aws:cognito-identity:${region}:${accountId}:identitypool`,
qualifiers: [`${region}:*`],
actions: [
"cognito-identity:CreateIdentityPool",
"cognito-identity:SetIdentityPoolRoles"
]
}
]
}
Expand Down Expand Up @@ -511,6 +593,7 @@ export class ServiceDeployIAM extends cdk.Stack {
static formatResourceQualifier(serviceName: string, prefix: string, qualifiers: string[]): string[] {
let delimiter = "/";
switch (serviceName) {
case "COGNITO":
case "CLOUD_WATCH":
case "LAMBDA":
case "S3":
Expand Down
Loading