AWS serverless-application-model documentation change
Summary
Added documentation about mixing IAM policies with SAM policy templates and clarified empty object requirements
Security assessment
Changes focus on policy syntax and template usage patterns without introducing new security features or addressing security vulnerabilities
Diff
diff --git a/serverless-application-model/latest/developerguide/serverless-policy-templates.md b/serverless-application-model/latest/developerguide/serverless-policy-templates.md index 4e7132853..b5ec1bff1 100644 --- a//serverless-application-model/latest/developerguide/serverless-policy-templates.md +++ b//serverless-application-model/latest/developerguide/serverless-policy-templates.md @@ -36,0 +37,4 @@ For every policy template you specify in your AWS SAM template file, you must al +###### Note + +If you have set up a regular IAM policy or have managed policies through Lambda, the policy template could be set without using an empty object. + @@ -74,0 +79,18 @@ Even though there are no placeholder values, you must specify an empty object, o +### Example 3: Policy template with placeholder values and a regular IAM policy + +The following example contains the AmazonSQSFullAcess policy and [DynamoDBCrudPolicy](./serverless-policy-template-list.html#dynamo-db-crud-policy) policy template. The AmazonSQSFullAccess policy is an IAM policy and not a AWS SAM policy, so you don't have to specify an empty object as the policy would be directly passed to the AWS CloudFormation. + + + MyFunction: + Type: 'AWS::Serverless::Function' + Properties: + CodeUri: ${codeuri} + Handler: hello.handler + Runtime: python2.7 + Policies: + - AmazonSQSFullAccess // IAM policy could be set without passing an empty object + - DynamoDBCrudPolicy: // SAM specific policy, has a defined structure + TableName: + !Ref SampleTable + +