Update CodeDeploy default policy to AWSCodeDeployRoleForLambdaLimited (#98)

vrr-21 · web-flow · commit aaf7fc72fb0d · 2020-12-23T16:24:25.000Z
* Updating CodeDeploy policy to AWSCodeDeployForLambdaLimited

* Adding SNS policy when TriggerConfigurations are provided

* Added trigger configurations check in buildCodeDeployRole method

* Add function to check trigger configurations

Authored-by: Varun Rao &lt;raovaru@amazon.com&gt;
diff --git a/fixtures/1.output.json b/fixtures/1.output.json
@@ -503,7 +503,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/10.output.v2-websocket.json b/fixtures/10.output.v2-websocket.json
@@ -817,7 +817,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/11.output.v2-websocket-authorizer.json b/fixtures/11.output.v2-websocket-authorizer.json
@@ -914,7 +914,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/12.output-with-permissions-boundary.json b/fixtures/12.output-with-permissions-boundary.json
@@ -503,7 +503,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/2.output.without-hooks.json b/fixtures/2.output.without-hooks.json
@@ -370,7 +370,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/5.output.with-trigger.json b/fixtures/5.output.with-trigger.json
@@ -503,8 +503,9 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
+          "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
+          "arn:aws:iam::aws:policy/AmazonSNSFullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",
diff --git a/fixtures/6.output.cloudwatch-events-trigger.json b/fixtures/6.output.cloudwatch-events-trigger.json
@@ -302,7 +302,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/7.output.cloudwatch-logs-trigger.json b/fixtures/7.output.cloudwatch-logs-trigger.json
@@ -295,7 +295,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/8.output.sns-subscriptions-trigger.json b/fixtures/8.output.sns-subscriptions-trigger.json
@@ -232,7 +232,7 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
           "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
         ],
         "AssumeRolePolicyDocument": {
diff --git a/fixtures/9.output.iot-topic-rule.json b/fixtures/9.output.iot-topic-rule.json
@@ -706,8 +706,9 @@
       "Type": "AWS::IAM::Role",
       "Properties": {
         "ManagedPolicyArns": [
-          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",
-          "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+          "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",
+          "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
+          "arn:aws:iam::aws:policy/AmazonSNSFullAccess"
         ],
         "AssumeRolePolicyDocument": {
           "Version": "2012-10-17",
@@ -865,4 +866,4 @@
       }
     }
   }
-}
+}
diff --git a/lib/CfTemplateGenerators/Iam.js b/lib/CfTemplateGenerators/Iam.js
@@ -1,11 +1,15 @@
-function buildCodeDeployRole (codeDeployRolePermissionsBoundaryArn) {
+function buildCodeDeployRole (codeDeployRolePermissionsBoundaryArn, areTriggerConfigurationsSet) {
+  const attachedPolicies = [
+    'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
+    'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
+  ]
+  if (areTriggerConfigurationsSet) {
+    attachedPolicies.push('arn:aws:iam::aws:policy/AmazonSNSFullAccess')
+  }
   const iamRoleCodeDeploy = {
     Type: 'AWS::IAM::Role',
     Properties: {
-      ManagedPolicyArns: [
-        'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda',
-        'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
-      ],
+      ManagedPolicyArns: attachedPolicies,
       AssumeRolePolicyDocument: {
         Version: '2012-10-17',
         Statement: [
diff --git a/lib/CfTemplateGenerators/Iam.test.js b/lib/CfTemplateGenerators/Iam.test.js
@@ -3,28 +3,56 @@ const Iam = require('./Iam')
 
 describe('Iam', () => {
   describe('.buildCodeDeployRole', () => {
-    it('should generate a AWS::IAM::Role resource', () => {
-      const expected = {
-        Type: 'AWS::IAM::Role',
-        Properties: {
-          ManagedPolicyArns: [
-            'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda',
-            'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
-          ],
-          AssumeRolePolicyDocument: {
-            Version: '2012-10-17',
-            Statement: [
-              {
-                Action: ['sts:AssumeRole'],
-                Effect: 'Allow',
-                Principal: { Service: ['codedeploy.amazonaws.com'] }
-              }
-            ]
+    context('when trigger configurations are not set', () => {
+      it('should generate a AWS::IAM::Role resource', () => {
+        const expected = {
+          Type: 'AWS::IAM::Role',
+          Properties: {
+            ManagedPolicyArns: [
+              'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
+              'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
+            ],
+            AssumeRolePolicyDocument: {
+              Version: '2012-10-17',
+              Statement: [
+                {
+                  Action: ['sts:AssumeRole'],
+                  Effect: 'Allow',
+                  Principal: { Service: ['codedeploy.amazonaws.com'] }
+                }
+              ]
+            }
           }
         }
-      }
-      const actual = Iam.buildCodeDeployRole()
-      expect(actual).to.deep.equal(expected)
+        const actual = Iam.buildCodeDeployRole(null, false)
+        expect(actual).to.deep.equal(expected)
+      })
+    })
+    context('when trigger configurations are set', () => {
+      it('should generate a AWS::IAM::Role resource', () => {
+        const expected = {
+          Type: 'AWS::IAM::Role',
+          Properties: {
+            ManagedPolicyArns: [
+              'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
+              'arn:aws:iam::aws:policy/AWSLambdaFullAccess',
+              'arn:aws:iam::aws:policy/AmazonSNSFullAccess'
+            ],
+            AssumeRolePolicyDocument: {
+              Version: '2012-10-17',
+              Statement: [
+                {
+                  Action: ['sts:AssumeRole'],
+                  Effect: 'Allow',
+                  Principal: { Service: ['codedeploy.amazonaws.com'] }
+                }
+              ]
+            }
+          }
+        }
+        const actual = Iam.buildCodeDeployRole(null, true)
+        expect(actual).to.deep.equal(expected)
+      })
     })
   })
   describe('.buildCodeDeployRole with IAM permissions boundary', () => {
@@ -33,7 +61,7 @@ describe('Iam', () => {
         Type: 'AWS::IAM::Role',
         Properties: {
           ManagedPolicyArns: [
-            'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda',
+            'arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited',
             'arn:aws:iam::aws:policy/AWSLambdaFullAccess'
           ],
           AssumeRolePolicyDocument: {
diff --git a/serverless-plugin-canary-deployments.js b/serverless-plugin-canary-deployments.js
@@ -40,8 +40,8 @@ class ServerlessCanaryDeployments {
   addCanaryDeploymentResources () {
     if (this.shouldDeployDeployGradually()) {
       const codeDeployApp = this.buildCodeDeployApp()
-      const codeDeployRole = this.buildCodeDeployRole()
       const functionsResources = this.buildFunctionsResources()
+      const codeDeployRole = this.buildCodeDeployRole(this.areTriggerConfigurationsSet(functionsResources))
       Object.assign(
         this.compiledTpl.Resources,
         codeDeployApp,
@@ -51,6 +51,20 @@ class ServerlessCanaryDeployments {
     }
   }
 
+  areTriggerConfigurationsSet (functionsResources) {
+    // Checking if the template has trigger configurations.
+    for (var resource of functionsResources) {
+      for (var key of Object.keys(resource)) {
+        if (resource[key].Type === 'AWS::CodeDeploy::DeploymentGroup') {
+          if (resource[key].Properties.TriggerConfigurations) {
+            return true
+          }
+        }
+      }
+    }
+    return false
+  }
+
   shouldDeployDeployGradually () {
     return this.withDeploymentPreferencesFns.length > 0 && this.currentStageEnabled()
   }
@@ -86,10 +100,10 @@ class ServerlessCanaryDeployments {
     return { [logicalName]: template }
   }
 
-  buildCodeDeployRole () {
+  buildCodeDeployRole (areTriggerConfigurationsSet) {
     if (this.globalSettings.codeDeployRole) return {}
     const logicalName = 'CodeDeployServiceRole'
-    const template = CfGenerators.iam.buildCodeDeployRole(this.globalSettings.codeDeployRolePermissionsBoundary)
+    const template = CfGenerators.iam.buildCodeDeployRole(this.globalSettings.codeDeployRolePermissionsBoundary, areTriggerConfigurationsSet)
     return { [logicalName]: template }
   }
 

Original file line number	Diff line number	Diff line change
`@@ -706,8 +706,9 @@`
`706`	`706`	`"Type": "AWS::IAM::Role",`
`707`	`707`	`"Properties": {`
`708`	`708`	`"ManagedPolicyArns": [`
`709`		`- "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda",`
`710`		`- "arn:aws:iam::aws:policy/AWSLambdaFullAccess"`
	`709`	`+ "arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambdaLimited",`
	`710`	`+ "arn:aws:iam::aws:policy/AWSLambdaFullAccess",`
	`711`	`+ "arn:aws:iam::aws:policy/AmazonSNSFullAccess"`
`711`	`712`	`],`
`712`	`713`	`"AssumeRolePolicyDocument": {`
`713`	`714`	`"Version": "2012-10-17",`
`@@ -865,4 +866,4 @@`
`865`	`866`	`}`
`866`	`867`	`}`
`867`	`868`	`}`
`868`		`-}`
	`869`	`+}`