Repository navigation
Validate permissions when certain resources are connected #2268
Description
As we build applications in AWS we are connecting services together and when you do so you need to provide permissions via resource or identity policies. As we validate a template it would be nice to validate that policies are in place as we connect resources together.
Parameters:
BucketName:
Type: String
Resources:
S3Bucket:
Type: 'AWS::S3::Bucket'
Properties:
BucketName: !Ref BucketName
AccessControl: Private
NotificationConfiguration:
QueueConfigurations:
- Queue: !GetAtt Queue.Arn
Event: 's3:PubObject'
Queue:
Type: AWS::SQS::Queue
Properties:
...
QueuePolicy:
Type: AWS::SQS::QueuePolicy
Properties:
Queues:
- !Ref Queue
PolicyDocument:
Statement:
- Principal:
Service: s3.amazon.com
Action: ...
Effect: "Allow"
Resource: !GetAtt Queue.Arn
Condition:
ArnLike:
"aws:SourceArn": !Sub "arn:aws:s3:*:*:${BucketName}"
StringEquals:
"aws:SourceAccount": !Ref AWS::AccountId
or
Resources:
...
ApiGatewayRootMethod:
Type: AWS::ApiGateway::Method
Properties:
AuthorizationType: NONE
HttpMethod: POST
Integration:
IntegrationHttpMethod: POST
Type: AWS_PROXY
Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${LambdaFunction.Arn}/invocations"
ResourceId: !GetAtt ApiGateway.RootResourceId
RestApiId: !Ref ApiGateway
LambdaFunction:
Type: AWS::Lambda::Function
Properties:
...
LambdaApiGatewayInvoke:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunction
FunctionName: !GetAtt lambdaFunction.Arn
Principal: apigateway.amazonaws.com
SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ApiGateway}/${ApiGatewayStageName}/POST/A few things that could make this tricky.
- When we write templates we will work around infinite looping which makes understanding connections between resources harder
- When needing to validate IAM roles for permissions we may not be able to parse that document or the role may not exist in the same templates as the resources
Activity