Replace deprecated AWS managed policy for codedeploy (#116)

After March 1, 2021, the AWS managed policies AWSLambdaReadOnlyAccess and AWSLambdaFullAccess will be deprecated and can no longer be attached to new IAM users. AWS Lambda has introduced a new AWS managed policy. The AWSLambda_FullAccess policy grants full access to Lambda, Lambda console features, and other related AWS services. This policy was created by scoping down the previous policy AWSLambdaFullAccess. fixes #115
davidgf · Mar 31, 2021 · 3c29abc · 3c29abc
1 parent 3ee442a
commit 3c29abc
Show file tree

Hide file tree

Showing 13 changed files with 16 additions and 16 deletions.
diff --git a/fixtures/1.output.json b/fixtures/1.output.json
@@ -515,7 +515,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/10.output.v2-websocket.json b/fixtures/10.output.v2-websocket.json
@@ -829,7 +829,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/11.output.v2-websocket-authorizer.json b/fixtures/11.output.v2-websocket-authorizer.json
@@ -926,7 +926,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/12.output-with-permissions-boundary.json b/fixtures/12.output-with-permissions-boundary.json
@@ -504,7 +504,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/13.output.multiple-function-hooks.json b/fixtures/13.output.multiple-function-hooks.json
@@ -290,7 +290,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/2.output.without-hooks.json b/fixtures/2.output.without-hooks.json
@@ -371,7 +371,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/5.output.with-trigger.json b/fixtures/5.output.with-trigger.json
@@ -515,7 +515,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
           "arn:aws:iam::aws:policy/AmazonSNSFullAccess"
         ],
         "AssumeRolePolicyDocument": {

diff --git a/fixtures/6.output.cloudwatch-events-trigger.json b/fixtures/6.output.cloudwatch-events-trigger.json
@@ -314,7 +314,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/7.output.cloudwatch-logs-trigger.json b/fixtures/7.output.cloudwatch-logs-trigger.json
@@ -307,7 +307,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/8.output.sns-subscriptions-trigger.json b/fixtures/8.output.sns-subscriptions-trigger.json
@@ -244,7 +244,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",

diff --git a/fixtures/9.output.iot-topic-rule.json b/fixtures/9.output.iot-topic-rule.json
@@ -718,7 +718,7 @@
       "Properties": {
         "ManagedPolicyArns": [
           "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
+          "arn:aws:iam::aws:policy/AWSLambda_FullAccess",
           "arn:aws:iam::aws:policy/AmazonSNSFullAccess"
         ],
         "AssumeRolePolicyDocument": {

diff --git a/lib/CfTemplateGenerators/Iam.js b/lib/CfTemplateGenerators/Iam.js
@@ -3,7 +3,7 @@ const _ = require('lodash/fp')
 function buildCodeDeployRole (codeDeployRolePermissionsBoundaryArn, areTriggerConfigurationsSet) {
   const attachedPolicies = [
     'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
-    'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
+    'arn:aws:iam::aws:policy/AWSLambda_FullAccess'
   ]
   if (areTriggerConfigurationsSet) {
     attachedPolicies.push('arn:aws:iam::aws:policy/AmazonSNSFullAccess')

diff --git a/lib/CfTemplateGenerators/Iam.test.js b/lib/CfTemplateGenerators/Iam.test.js
@@ -10,7 +10,7 @@ describe('Iam', () => {
           Properties: {
             ManagedPolicyArns: [
               'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
-              'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
+              'arn:aws:iam::aws:policy/AWSLambda_FullAccess'
             ],
             AssumeRolePolicyDocument: {
               Version: '2012-10-17',
@@ -35,7 +35,7 @@ describe('Iam', () => {
           Properties: {
             ManagedPolicyArns: [
               'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
-              'arn:aws:iam::aws:policy/AWSLambdaFullAccess',
+              'arn:aws:iam::aws:policy/AWSLambda_FullAccess',
               'arn:aws:iam::aws:policy/AmazonSNSFullAccess'
             ],
             AssumeRolePolicyDocument: {
@@ -62,7 +62,7 @@ describe('Iam', () => {
         Properties: {
           ManagedPolicyArns: [
             'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
-            'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
+            'arn:aws:iam::aws:policy/AWSLambda_FullAccess'
           ],
           AssumeRolePolicyDocument: {
             Version: '2012-10-17',
@@ -201,7 +201,7 @@ describe('Iam', () => {
           Properties: {
             ManagedPolicyArns: [
               'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
-              'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
+              'arn:aws:iam::aws:policy/AWSLambda_FullAccess'
             ],
             AssumeRolePolicyDocument: {
               Version: '2012-10-17',