在CodeStar项目中的CloudFormation模板中更改Lambda的IAM角色？

2 回答

• 0

  CodeStar Service使用名为aws-codestar-service-role的服务角色，并带有以下语句 . 如果允许项目的动态辅助角色继承IAM角色创建操作，则可能需要修改此服务角色 . 否则CodeStar可能会覆盖您的更改 .

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "ProjectStack",
        "Effect": "Allow",
        "Action": [
          "cloudformation:*Stack*",
          "cloudformation:GetTemplate"
        ],
        "Resource": [
          "arn:aws:cloudformation:*:*:stack/awscodestar-*",
          "arn:aws:cloudformation:*:*:stack/awseb-*"
        ]
      },
      {
        "Sid": "ProjectStackTemplate",
        "Effect": "Allow",
        "Action": [
          "cloudformation:GetTemplateSummary",
          "cloudformation:DescribeChangeSet"
        ],
        "Resource": "*"
      },
      {
        "Sid": "ProjectQuickstarts",
        "Effect": "Allow",
        "Action": [
          "s3:GetObject"
        ],
        "Resource": [
          "arn:aws:s3:::awscodestar-*/*"
        ]
      },
      {
        "Sid": "ProjectS3Buckets",
        "Effect": "Allow",
        "Action": [
          "s3:*"
        ],
        "Resource": [
          "arn:aws:s3:::aws-codestar-*",
          "arn:aws:s3:::aws-codestar-*/*",
          "arn:aws:s3:::elasticbeanstalk-*",
          "arn:aws:s3:::elasticbeanstalk-*/*"
        ]
      },
      {
        "Sid": "ProjectServices",
        "Effect": "Allow",
        "Action": [
          "codestar:*Project",
          "codestar:*Resource*",
          "codestar:List*",
          "codestar:Describe*",
          "codestar:Get*",
          "codestar:AssociateTeamMember",
          "codecommit:*",
          "codepipeline:*",
          "codedeploy:*",
          "codebuild:*",
          "ec2:RunInstances",
          "autoscaling:*",
          "cloudwatch:Put*",
          "ec2:*",
          "elasticbeanstalk:*",
          "elasticloadbalancing:*",
          "iam:ListRoles",
          "logs:*",
          "sns:*"
        ],
        "Resource": "*"
      },
      {
        "Sid": "ProjectWorkerRoles",
        "Effect": "Allow",
        "Action": [
          "iam:AttachRolePolicy",
          "iam:CreateRole",
          "iam:DeleteRole",
          "iam:DeleteRolePolicy",
          "iam:DetachRolePolicy",
          "iam:GetRole",
          "iam:PassRole",
          "iam:PutRolePolicy",
          "iam:SetDefaultPolicyVersion",
          "iam:CreatePolicy",
          "iam:DeletePolicy",
          "iam:AddRoleToInstanceProfile",
          "iam:CreateInstanceProfile",
          "iam:DeleteInstanceProfile",
          "iam:RemoveRoleFromInstanceProfile"
        ],
        "Resource": [
          "arn:aws:iam::*:role/CodeStarWorker*",
          "arn:aws:iam::*:policy/CodeStarWorker*",
          "arn:aws:iam::*:instance-profile/awscodestar-*"
        ]
      },
      {
        "Sid": "ProjectTeamMembers",
        "Effect": "Allow",
        "Action": [
          "iam:AttachUserPolicy",
          "iam:DetachUserPolicy"
        ],
        "Resource": "*",
        "Condition": {
          "ArnEquals": {
            "iam:PolicyArn": [
              "arn:aws:iam::*:policy/CodeStar_*"
            ]
          }
        }
      },
      {
        "Sid": "ProjectRoles",
        "Effect": "Allow",
        "Action": [
          "iam:CreatePolicy",
          "iam:DeletePolicy",
          "iam:CreatePolicyVersion",
          "iam:DeletePolicyVersion",
          "iam:ListEntitiesForPolicy",
          "iam:ListPolicyVersions"
        ],
        "Resource": [
          "arn:aws:iam::*:policy/CodeStar_*"
        ]
      },
      {
        "Sid": "InspectServiceRole",
        "Effect": "Allow",
        "Action": [
          "iam:ListAttachedRolePolicies"
        ],
        "Resource": [
          "arn:aws:iam::*:role/aws-codestar-service-role"
        ]
      }
    ]
  }
  

  另请参阅http://docs.aws.amazon.com/codestar/latest/userguide/access-permissions.html，但您可能已经猜到了，它可以覆盖您的用例 .

  回复于 2024-04-29T04:22:05+08:00
• 1

  我相信答案是CodeStar似乎与它在不同情况下创建角色所使用的命名约定不一致 . 如果在创建角色时提供前缀为 CodeStar-[projectId]* 的名称，则这将满足CodeStarWorker- [projectId] -CloudFormation角色的IAM策略 . 即包括`RoleName：！Sub 'CodeStar-$-....' .

  Further information 当我遇到同样的错误时，我还要更新IAM策略，然后注意到CodeStarWorker- [projectId] -CloudFormation角色的IAM策略中的权限边界 . 将错误中的角色与现有角色进行比较：

  错误中的角色： awscodestar-[projectId]-lambda-HelloWorldLambdaRole-ABCDEF123456 .

  CodeStar创建的角色示例代码： CodeStar-[projectId]-Execution

  另外一点是，如果您使用SAM CLI来CodeStar，这会让您感到困惑，因为CLI可以指定没有角色的lambda函数，SAM会为您创建它，例如：

  $ sam init --name test_sam
  $ cat test_sam/template.yml
  HelloWorldFunction:
      Type: AWS::Serverless::Function
      Properties:
          CodeUri: hello-world/
          Handler: app.lambdaHandler
          Runtime: nodejs8.10
          Environment: 
              Variables:
                  PARAM1: VALUE
          Events:
              HelloWorld:
                  Type: Api
                  Properties:
                      Path: /hello
                      Method: get
  

  但是，在CodeStar中这不起作用，看起来您需要遵循CodeStar的示例并指定功能资源，以及具有正确名称前缀的角色！例如

  Resources:
    HelloWorld:
      Type: AWS::Serverless::Function
      Properties:
        Handler: index.handler
        Runtime: python3.7
        Role:
          Fn::GetAtt:
          - LambdaExecutionRole
          - Arn
        Events:
          GetEvent:
            Type: Api
            Properties:
              Path: /
              Method: get
    LambdaExecutionRole:
      Description: Creating service role in IAM for AWS Lambda
      Type: AWS::IAM::Role
      Properties:
        RoleName: !Sub 'CodeStar-${ProjectId}-Execution${Stage}'
        AssumeRolePolicyDocument:
          Statement:
          - Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com]
            Action: sts:AssumeRole
        Path: /
        ManagedPolicyArns:
          -  ....
  

  回复于 2024-04-29T04:22:05+08:00