AWS serverless-application-model high security documentation change
Summary
Added Schema Registry configuration documentation, IAM role requirements, example policies, and usage examples for AWS Glue/Confluent schema registries. Fixed 'minumum' typo.
Security assessment
Added explicit IAM policies for Glue schema registry access and secret management. Missing these permissions could lead to unauthorized access to schema resources or secrets. The documentation now mandates security configurations for schema validation features.
Diff
diff --git a/serverless-application-model/latest/developerguide/sam-property-function-msk.md b/serverless-application-model/latest/developerguide/sam-property-function-msk.md index 3be303f4d..bac8c97b5 100644 --- a//serverless-application-model/latest/developerguide/sam-property-function-msk.md +++ b//serverless-application-model/latest/developerguide/sam-property-function-msk.md @@ -12,0 +13,2 @@ AWS Serverless Application Model (AWS SAM) generates an [AWS::Lambda::EventSourc +To use Schema Registry, you need to define specific IAM role permissions for your function. See Complete setup with IAM roles for an example of the required configuration. + @@ -25,0 +28 @@ To declare this entity in your AWS SAM template, use the following syntax. + SchemaRegistryConfig: [SchemaRegistryConfig](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-schemaregistryconfig.html) @@ -95 +98 @@ _AWS CloudFormation compatibility_ : This property is passed directly to the `[M -Configuration to increase the amount of pollers used to compute event source mappings. This configuration allows for a minumum of 1 poller and a maximum of 20 pollers. For an example, refer to ProvisionedPollerConfig example. +Configuration to increase the amount of pollers used to compute event source mappings. This configuration allows for a minimum of 1 poller and a maximum of 20 pollers. For an example, refer to ProvisionedPollerConfig example. @@ -102,0 +106,15 @@ _AWS CloudFormation compatibility_ : This property is passed directly to the `[P +`SchemaRegistryConfig` + + +Configuration for using a schema registry with the Kafka event source. + +###### Note + +This feature requires `ProvisionedPollerConfig` to be configured. + +_Type_ : SchemaRegistryConfig + +_Required_ : No + +_AWS CloudFormation compatibility:_ This property is passed directly to the `[AmazonManagedKafkaEventSourceConfig](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig)` property of an `AWS::Lambda::EventSourceMapping` resource. + @@ -114 +132 @@ _Required_ : No -_AWS CloudFormation compatibility_ : This property is passed directly to the `[SourceAccessConfigurations](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-eventsourcemapping.html#cfn-lambda-eventsourcemapping-sourceaccessconfigurations)` property of an `AWS::Lambda::EventSourceMapping` resource. +_AWS CloudFormation compatibility:_ This propertyrty is part of the [AmazonManagedKafkaEventSourceConfig](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-eventsourcemapping-amazonmanagedkafkaeventsourceconfig) property of an `AWS::Lambda::EventSourceMapping` resource. @@ -172,0 +191,110 @@ _AWS CloudFormation compatibility_ : This property is passed directly to the `[T +### Complete setup with IAM roles + +The following example shows a complete setup including the required IAM role configuration for using Schema Registry: + + + Parameters: + PreCreatedSubnetOne: + Type: String + PreCreatedSubnetTwo: + Type: String + MskClusterName4: + Type: String + + Resources: + MyLambdaExecutionRole: + Type: AWS::IAM::Role + Properties: + AssumeRolePolicyDocument: + Version: '2012-10-17' + Statement: + - Action: [sts:AssumeRole] + Effect: Allow + Principal: + Service: [lambda.amazonaws.com] + Policies: + - PolicyName: KafkaClusterPermissions + PolicyDocument: + Statement: + - Action: [kafka:DescribeClusterV2, kafka:GetBootstrapBrokers] + Effect: Allow + Resource: 'arn:aws:kafka:us-east-1:123456789012:cluster/*' + - PolicyName: KafkaAuthPolicy + PolicyDocument: + Statement: + - Action: [secretsmanager:GetSecretValue, kms:Decrypt] + Effect: "Allow" + Resource: ['arn:aws:secretsmanager:us-west-2:123456789012:secret:kafkaSecret-******', + 'arn:aws:kms:us-west-2:123456789012:key/keyId'] + - PolicyName: ENIPolicy + PolicyDocument: + Statement: + - Action: [ec2:CreateNetworkInterface, + ec2:DescribeNetworkInterfaces, ec2:DescribeVpcs, ec2:DeleteNetworkInterface, + ec2:DescribeSubnets, ec2:DescribeSecurityGroups] + Effect: Allow + Resource: '*' + - PolicyName: SchemaRegistryPolicy + PolicyDocument: + Statement: + - Action: [glue:GetRegistry] + Effect: Allow + Resource: 'arn:aws:glue:{region}:{account-id}:registry/{registry-name}' + - PolicyName: SchemaVersionsPolicy + PolicyDocument: + Statement: + - Action: [glue:GetSchemaVersions] + Effect: Allow + Resource: '*' + ManagedPolicyArns: + - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole + Tags: + - {Value: SAM, Key: lambda:createdBy} + + MyMskCluster: + Type: AWS::MSK::Cluster + Properties: + BrokerNodeGroupInfo: + ClientSubnets: + - Ref: PreCreatedSubnetOne + - Ref: PreCreatedSubnetTwo + InstanceType: kafka.t3.small + StorageInfo: + EBSStorageInfo: + VolumeSize: 1 + ClusterName: + Ref: MskClusterName4 + KafkaVersion: 3.8.x + NumberOfBrokerNodes: 2 + + MyMskStreamProcessor: + Type: AWS::Serverless::Function + Properties: + Runtime: nodejs18.x + Handler: index.handler + CodeUri: ${codeuri} + Role: + Fn::GetAtt: [MyLambdaExecutionRole, Arn] + Events: + MyMskEvent: + Type: MSK + Properties: + StartingPosition: LATEST + Stream: + Ref: MyMskCluster + SourceAccessConfigurations: + - Type: SASL_SCRAM_512_AUTH + URI: !Sub arn:${AWS::Partition}:secretsmanager:us-west-2:123456789012:secret:my-path/my-secret-name-1a2b3c + Topics: + - SchemaRegistryTestTopic + ProvisionedPollerConfig: + MinimumPollers: 1 + SchemaRegistryConfig: + AccessConfigs: + - Type: BASIC_AUTH + URI: !Sub arn:${AWS::Partition}:secretsmanager:us-west-2:123456789012:secret:my-path/my-secret-name-1a2b3c + SchemaValidationConfigs: + - Attribute: KEY + EventRecordFormat: JSON + SchemaRegistryURI: !Sub arn:${AWS::Partition}:glue:us-west-2:123456789012:registry/myregistry + @@ -214,0 +343,49 @@ The following is an example of an `MSK` event source type for an Amazon MSK clus +#### MSK Event Source with Schema Registry + +The following is an example of an `MSK` event source type configured with a schema registry. + + + Events: + MSKEvent: + Type: MSK + Properties: + StartingPosition: LATEST + Stream: + Ref: MyMskCluster + Topics: + - SchemaRegistryTestTopic + ProvisionedPollerConfig: + MinimumPollers: 1 + SchemaRegistryConfig: + SchemaRegistryURI: !Sub arn:${AWS::Partition}:glue:us-west-2:123456789012:registry/myregistry + EventRecordFormat: JSON + SchemaValidationConfigs: + - Attribute: KEY + - Attribute: VALUE + +#### MSK Event Source with Confluent Schema Registry + +The following is an example of an `MSK` event source type configured with a Confluent Schema Registry. + + + Events: + MSKEvent: + Type: MSK + Properties: + StartingPosition: LATEST + Stream: + Ref: MyMskCluster + Topics: + - SchemaRegistryTestTopic + ProvisionedPollerConfig: + MinimumPollers: 1 + SchemaRegistryConfig: + SchemaRegistryURI: https://my-schema-registry.confluent.cloud + AccessConfigs: + - Type: BASIC_AUTH + URI: !Sub arn:${AWS::Partition}:secretsmanager:us-west-2:123456789012:secret:my-secret + EventRecordFormat: JSON + SchemaValidationConfigs: + - Attribute: KEY + - Attribute: VALUE +