module StackBuilder::LambdaPolicy
Public Instance Methods
add_lambda_iam_role(function_name: nil)
click to toggle source
add inline iam role to lambda, NOTE: use the same role for all lambdas for now
# File lib/modulator/stack/policies.rb, line 6 def add_lambda_iam_role(function_name: nil) StackBuilder.stack.add('LambdaRole', Humidifier::IAM::Role.new( assume_role_policy_document: { "Version" => "2012-10-17", 'Statement' => [ { "Action" => ["sts:AssumeRole"], "Effect" => "Allow", 'Principal' => { 'Service' => ["lambda.amazonaws.com"] } } ] }, policies: [] ) ) end
add_policy(policy, **opts)
click to toggle source
# File lib/modulator/stack/policies.rb, line 25 def add_policy(policy, **opts) StackBuilder.stack.resources['LambdaRole'].properties['policies'] << send(policy, opts) end
cloudwatch(**opts)
click to toggle source
policy to access cloudwatch
# File lib/modulator/stack/policies.rb, line 30 def cloudwatch(**opts) { "policy_document" => { "Version" => "2012-10-17", 'Statement' => [ { "Sid" => "AllowLogCreation", "Action" => [ "logs:CreateLogStream", "logs:PutLogEvents", ], "Effect" => "Allow", "Resource" => Humidifier.fn.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*") }, { "Sid" => "AllowLogGroupCreation", "Action" => [ "logs:CreateLogGroup", ], "Effect" => "Allow", "Resource" => "*" } ] }, "policy_name" => "cloud-watch-access" } end
dynamo_db(**opts)
click to toggle source
policy to access prefixed dynamo tables
# File lib/modulator/stack/policies.rb, line 59 def dynamo_db(**opts) prefixes = opts[:prefixes] || [] prefix_separator = opts[:prefix_separator] || '-' wildcard = '*' if prefixes.any? prefixes.map!{|prefix| prefix == :app_name ? StackBuilder.stack.app_name.dasherize.split('-') : prefix} wildcard = "#{(prefixes << '*').join(prefix_separator)}" end { "policy_document" => { "Version" => "2012-10-17", 'Statement' => [ { "Sid" => "AllowAllActionsOnPrefixedTable", "Effect" => "Allow", "Action" => [ "dynamodb:*" ], "Resource" => Humidifier.fn.sub("arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/#{wildcard}") }, { "Sid" => "AdditionalPrivileges", "Effect" => "Allow", "Action" => [ "dynamodb:ListTables", "dynamodb:DescribeTable" ], "Resource" => "*" } ] }, "policy_name" => "dynamo-db-access" } end
secret_manager(**opts)
click to toggle source
TODO: add access to named secrets
# File lib/modulator/stack/policies.rb, line 95 def secret_manager(**opts) end