Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/compress iam role policy #43

Merged
merged 6 commits into from
May 1, 2024
Merged

Fix/compress iam role policy #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
aa4f907
compress iam role policy under the limit of 10240 bytes
Apr 19, 2024
fcc53f9
Merge branch 'feature/introduce_code_formatter' into fix/compress_iam…
Apr 19, 2024
cffa02f
update test script to match policy changes
Apr 19, 2024
2d07e6f
address single-element array being translated to a string
Apr 19, 2024
d126df0
roll-back unnecessary change
Apr 19, 2024
2141a5c
Merge branch 'main' into fix/compress_iam_role_policy
Apr 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 14 additions & 90 deletions packages/serverless-deploy-iam/bin/app.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,22 +111,7 @@ export class ServiceDeployIAM extends cdk.Stack {
`:log-stream:*`,
`${serviceName}*`,
],
actions: [
"logs:CreateLogGroup",
"logs:DescribeLogGroups",
"logs:DeleteLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogStreams",
"logs:DeleteLogStream",
"logs:FilterLogEvents",
"logs:TagResource",
"logs:UntagResource",
"logs:DescribeMetricFilters",
"logs:PutMetricFilter",
"logs:ListTagsForResource",
"logs:PutDataProtectionPolicy",
"logs:UpdateDataProtectionPolicy",
],
actions: ["logs:*"],
},
{
name: "CLOUD_WATCH",
Expand All @@ -138,17 +123,11 @@ export class ServiceDeployIAM extends cdk.Stack {
prefix: `arn:aws:cloudwatch:${region}:${accountId}:alarm:`,
qualifiers: [`TaskTimedOutAlarm`, `${serviceName}*`],
actions: [
"cloudwatch:ListMetrics",
"cloudwatch:ListMetricStreams",
"cloudwatch:ListTagsForResource",
"cloudwatch:ListDashboards",
"cloudwatch:List*",
"cloudwatch:DescribeAlarms",
"cloudwatch:DeleteAlarms",
"cloudwatch:EnableAlarmActions",
"cloudwatch:PutMetricAlarm",
"cloudwatch:PutDashboard",
"cloudwatch:PutMetricData",
"cloudwatch:PutMetricStream",
"cloudwatch:Put*",
"cloudwatch:SetAlarmState",
"cloudwatch:TagResource",
"cloudwatch:StartMetricStreams",
Expand All @@ -159,34 +138,7 @@ export class ServiceDeployIAM extends cdk.Stack {
name: "LAMBDA",
prefix: `arn:aws:lambda:${region}:${accountId}:function:`,
qualifiers: [`${serviceName}*`],
actions: [
"lambda:GetFunction",
"lambda:CreateFunction",
"lambda:DeleteFunction",
"lambda:UpdateFunctionConfiguration",
"lambda:UpdateFunctionCode",
"lambda:ListVersionsByFunction",
"lambda:PublishVersion",
"lambda:CreateAlias",
"lambda:DeleteAlias",
"lambda:UpdateAlias",
"lambda:GetFunctionConfiguration",
"lambda:AddPermission",
"lambda:RemovePermission",
"lambda:InvokeFunction",
"lambda:ListTags",
"lambda:TagResource",
"lambda:UntagResource",
"lambda:PutFunctionConcurrency",
"lambda:DeleteEventSourceMapping",
"lambda:UpdateEventSourceMapping",
"lambda:CreateFunctionUrlConfig",
"lambda:DeleteFunctionUrlConfig",
"lambda:GetFunctionUrlConfig",
"lambda:ListFunctionUrlConfigs",
"lambda:UpdateFunctionUrlConfig",
"lambda:DeleteFunctionConcurrency",
],
actions: ["lambda:*"],
},
{
name: "LAMBDA",
Expand Down Expand Up @@ -335,15 +287,9 @@ export class ServiceDeployIAM extends cdk.Stack {
actions: [
"cognito-sync:BulkPublish",
"cognito-sync:DeleteDataset",
"cognito-sync:DescribeDataset",
"cognito-sync:DescribeIdentityPoolUsage",
"cognito-sync:DescribeIdentityUsage",
"cognito-sync:GetBulkPublishDetails",
"cognito-sync:GetCognitoEvents",
"cognito-sync:GetIdentityPoolConfiguration",
"cognito-sync:ListDatasets",
"cognito-sync:ListIdentityPoolUsage",
"cognito-sync:ListRecords",
"cognito-sync:Describe*",
"cognito-sync:Get*",
"cognito-sync:List*",
"cognito-sync:QueryRecords",
"cognito-sync:RegisterDevice",
"cognito-sync:SetCognitoEvents",
Expand All @@ -355,17 +301,9 @@ export class ServiceDeployIAM extends cdk.Stack {
"cognito-identity:CreateIdentityPool",
"cognito-identity:DeleteIdentities",
"cognito-identity:DeleteIdentityPool",
"cognito-identity:DescribeIdentity",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:GetCredentialsForIdentity",
"cognito-identity:GetId",
"cognito-identity:GetIdentityPoolRoles",
"cognito-identity:GetOpenIdToken",
"cognito-identity:GetOpenIdTokenForDeveloperIdentity",
"cognito-identity:GetPrincipalTagAttributeMap",
"cognito-identity:ListIdentities",
"cognito-identity:ListIdentityPools",
"cognito-identity:ListTagsForResource",
"cognito-identity:Describe*",
"cognito-identity:Get*",
"cognito-identity:List*",
"cognito-identity:LookupDeveloperIdentity",
"cognito-identity:MergeDeveloperIdentities",
"cognito-identity:SetIdentityPoolRoles",
Expand All @@ -381,17 +319,7 @@ export class ServiceDeployIAM extends cdk.Stack {
name: "COGNITO_IDP",
prefix: `arn:aws:cognito-idp:${region}:${accountId}:userpool`,
qualifiers: [`${serviceName}*`, `${region}_*`],
actions: [
"cognito-idp:Create*",
"cognito-idp:Delete*",
"cognito-idp:Describe*",
"cognito-idp:Get*",
"cognito-idp:List*",
"cognito-idp:Set*",
"cognito-idp:TagResource",
"cognito-idp:UntagResource",
"cognito-idp:Update*",
],
actions: ["cognito-idp:*"],
},
{
name: "COGNITO_IDP_CREATEUSERPOOL",
Expand Down Expand Up @@ -509,18 +437,14 @@ export class ServiceDeployIAM extends cdk.Stack {
qualifiers: [`${serviceName}*`],
actions: [
"cloudformation:CreateStack",
"cloudformation:DescribeStacks",
"cloudformation:Describe*",
"cloudformation:List*",
"cloudformation:Get*",
"cloudformation:DeleteStack",
"cloudformation:DescribeStackEvents",
"cloudformation:UpdateStack",
"cloudformation:ExecuteChangeSet",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:ListStackResources",
"cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplate",
],
},
{
Expand Down
39 changes: 7 additions & 32 deletions packages/serverless-deploy-iam/test/deploy-role.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,18 +55,14 @@ describe("Deploy user policy", () => {
objectLike({
Action: [
"cloudformation:CreateStack",
"cloudformation:DescribeStacks",
"cloudformation:Describe*",
"cloudformation:List*",
"cloudformation:Get*",
"cloudformation:DeleteStack",
"cloudformation:DescribeStackEvents",
"cloudformation:UpdateStack",
"cloudformation:ExecuteChangeSet",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:ListStackResources",
"cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplate",
],
Effect: "Allow",
Resource: [
Expand Down Expand Up @@ -148,7 +144,7 @@ describe("Deploy user policy", () => {
);
});

test("has correct CloudWatch permissions", () => {
test("has correct CloudWatch logs permissions", () => {
const app = new cdk.App();
const stack = new ServiceDeployIAM(app, "jest-deploy-iam");
expectCDK(stack).to(
Expand All @@ -157,22 +153,7 @@ describe("Deploy user policy", () => {
PolicyDocument: {
Statement: arrayWith(
objectLike({
Action: [
"logs:CreateLogGroup",
"logs:DescribeLogGroups",
"logs:DeleteLogGroup",
"logs:CreateLogStream",
"logs:DescribeLogStreams",
"logs:DeleteLogStream",
"logs:FilterLogEvents",
"logs:TagResource",
"logs:UntagResource",
"logs:DescribeMetricFilters",
"logs:PutMetricFilter",
"logs:ListTagsForResource",
"logs:PutDataProtectionPolicy",
"logs:UpdateDataProtectionPolicy",
],
Action: "logs:*",
Effect: "Allow",
Resource: [
{
Expand Down Expand Up @@ -278,17 +259,11 @@ describe("Deploy user policy", () => {
Statement: arrayWith(
objectLike({
Action: [
"cloudwatch:ListMetrics",
"cloudwatch:ListMetricStreams",
"cloudwatch:ListTagsForResource",
"cloudwatch:ListDashboards",
"cloudwatch:List*",
"cloudwatch:DescribeAlarms",
"cloudwatch:DeleteAlarms",
"cloudwatch:EnableAlarmActions",
"cloudwatch:PutMetricAlarm",
"cloudwatch:PutDashboard",
"cloudwatch:PutMetricData",
"cloudwatch:PutMetricStream",
"cloudwatch:Put*",
"cloudwatch:SetAlarmState",
"cloudwatch:TagResource",
"cloudwatch:StartMetricStreams",
Expand Down
Loading