Skip to content

Commit

Permalink
Only add merged IAM policies for Lambda when they will be used (#6262)
Browse files Browse the repository at this point in the history
  • Loading branch information
@onebytegone
onebytegone committed Aug 13, 2019
1 parent d4c8bc1 commit 56d96c4
Show file tree
Hide file tree
Showing 2 changed files with 200 additions and 15 deletions.
29 changes: 17 additions & 12 deletions lib/plugins/aws/package/lib/mergeIamTemplates.js
View file
Expand Up @@ -90,23 +90,13 @@ module.exports = {
.Resources[this.provider.naming.getRoleLogicalId()].Properties.Policies[0].PolicyDocument
.Statement;

// Ensure general polices for functions with default name resolution
policyDocumentStatements[0].Resource.push({
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}' +
`:log-group:${logGroupsPrefix}*:*`,
});

policyDocumentStatements[1].Resource.push({
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}' +
`:log-group:${logGroupsPrefix}*:*:*`,
});
let hasOneOrMoreCanonicallyNamedFunctions = false;

// Ensure policies for functions with custom name resolution
this.serverless.service.getAllFunctions().forEach(functionName => {
const { name: resolvedFunctionName } = this.serverless.service.getFunction(functionName);
if (!resolvedFunctionName || resolvedFunctionName.startsWith(canonicalFunctionNamePrefix)) {
hasOneOrMoreCanonicallyNamedFunctions = true;
return;
}

Expand All @@ -127,6 +117,21 @@ module.exports = {
});
});

if (hasOneOrMoreCanonicallyNamedFunctions) {
// Ensure general policies for functions with default name resolution
policyDocumentStatements[0].Resource.push({
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}' +
`:log-group:${logGroupsPrefix}*:*`,
});

policyDocumentStatements[1].Resource.push({
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}' +
`:log-group:${logGroupsPrefix}*:*:*`,
});
}

if (this.serverless.service.provider.iamRoleStatements) {
// add custom iam role statements
this.serverless.service.provider.compiledCloudFormationTemplate.Resources[
Expand Down
186 changes: 183 additions & 3 deletions lib/plugins/aws/package/lib/mergeIamTemplates.test.js
View file
Expand Up @@ -127,7 +127,7 @@ describe('#mergeIamTemplates()', () => {
});
}));

it('should ensure IAM policies for custom named functions', () => {
it('should ensure IAM policies when service contains only custom named functions', () => {
const customFunctionName = 'foo-bar';
awsPackage.serverless.service.functions = {
[functionName]: {
Expand All @@ -138,6 +138,91 @@ describe('#mergeIamTemplates()', () => {
};
serverless.service.setFunctionNames(); // Ensure to resolve function names

return awsPackage.mergeIamTemplates().then(() => {
expect(
awsPackage.serverless.service.provider.compiledCloudFormationTemplate.Resources[
awsPackage.provider.naming.getRoleLogicalId()
]
).to.deep.equal({
Type: 'AWS::IAM::Role',
Properties: {
AssumeRolePolicyDocument: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Principal: {
Service: ['lambda.amazonaws.com'],
},
Action: ['sts:AssumeRole'],
},
],
},
Path: '/',
Policies: [
{
PolicyName: {
'Fn::Join': [
'-',
[awsPackage.provider.getStage(), awsPackage.serverless.service.service, 'lambda'],
],
},
PolicyDocument: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: ['logs:CreateLogStream'],
Resource: [
{
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${customFunctionName}:*`,
},
],
},
{
Effect: 'Allow',
Action: ['logs:PutLogEvents'],
Resource: [
{
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${customFunctionName}:*:*`,
},
],
},
],
},
},
],
RoleName: {
'Fn::Join': [
'-',
[
awsPackage.serverless.service.service,
awsPackage.provider.getStage(),
{
Ref: 'AWS::Region',
},
'lambdaRole',
],
],
},
},
});
});
});

it('should ensure IAM policies when service contains only canonically named functions', () => {
awsPackage.serverless.service.functions = {
[functionName]: {
artifact: 'test.zip',
handler: 'handler.hello',
},
};
serverless.service.setFunctionNames(); // Ensure to resolve function names

return awsPackage.mergeIamTemplates().then(() => {
const canonicalFunctionsPrefix = `${
awsPackage.serverless.service.service
Expand Down Expand Up @@ -183,11 +268,106 @@ describe('#mergeIamTemplates()', () => {
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${canonicalFunctionsPrefix}*:*`,
},
],
},
{
Effect: 'Allow',
Action: ['logs:PutLogEvents'],
Resource: [
{
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${canonicalFunctionsPrefix}*:*:*`,
},
],
},
],
},
},
],
RoleName: {
'Fn::Join': [
'-',
[
awsPackage.serverless.service.service,
awsPackage.provider.getStage(),
{
Ref: 'AWS::Region',
},
'lambdaRole',
],
],
},
},
});
});
});

it('should ensure IAM policies for custom and canonically named functions', () => {
const customFunctionName = 'foo-bar';
awsPackage.serverless.service.functions = {
[functionName]: {
name: customFunctionName,
artifact: 'test.zip',
handler: 'handler.hello',
},
test2: {
artifact: 'test.zip',
handler: 'handler.hello',
},
};
serverless.service.setFunctionNames(); // Ensure to resolve function names

return awsPackage.mergeIamTemplates().then(() => {
const canonicalFunctionsPrefix = `${
awsPackage.serverless.service.service
}-${awsPackage.provider.getStage()}`;

expect(
awsPackage.serverless.service.provider.compiledCloudFormationTemplate.Resources[
awsPackage.provider.naming.getRoleLogicalId()
]
).to.deep.equal({
Type: 'AWS::IAM::Role',
Properties: {
AssumeRolePolicyDocument: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Principal: {
Service: ['lambda.amazonaws.com'],
},
Action: ['sts:AssumeRole'],
},
],
},
Path: '/',
Policies: [
{
PolicyName: {
'Fn::Join': [
'-',
[awsPackage.provider.getStage(), awsPackage.serverless.service.service, 'lambda'],
],
},
PolicyDocument: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: ['logs:CreateLogStream'],
Resource: [
{
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${customFunctionName}:*`,
},
{
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${canonicalFunctionsPrefix}*:*`,
},
],
},
{
Expand All @@ -197,12 +377,12 @@ describe('#mergeIamTemplates()', () => {
{
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${canonicalFunctionsPrefix}*:*:*`,
`log-group:/aws/lambda/${customFunctionName}:*:*`,
},
{
'Fn::Sub':
'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:' +
`log-group:/aws/lambda/${customFunctionName}:*:*`,
`log-group:/aws/lambda/${canonicalFunctionsPrefix}*:*:*`,
},
],
},
Expand Down

0 comments on commit 56d96c4

Please sign in to comment.