AWS serverless-application-model documentation change
Summary
Removed detailed JSON policy example for SAM permissions
Security assessment
Removal of a policy example doesn't indicate a security fix, though it reduces documentation about required permissions.
Diff
diff --git a/serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md b/serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md index e3a9bd8ac..5d398f2f4 100644 --- a//serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md +++ b//serverless-application-model/latest/developerguide/sam-permissions-cloudformation.md @@ -69,148 +68,0 @@ With the modified Hello World application in place, the following policy stateme -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "CloudFormationTemplate", - "Effect": "Allow", - "Action": [ - "cloudformation:CreateChangeSet" - ], - "Resource": [ - "arn:aws:cloudformation:us-east-1:aws:transform/Serverless-2016-10-31" - ] - }, - { - "Sid": "CloudFormationStack", - "Effect": "Allow", - "Action": [ - "cloudformation:CreateChangeSet", - "cloudformation:CreateStack", - "cloudformation:DeleteStack", - "cloudformation:DescribeChangeSet", - "cloudformation:DescribeStackEvents", - "cloudformation:DescribeStacks", - "cloudformation:ExecuteChangeSet", - "cloudformation:GetTemplateSummary", - "cloudformation:ListStackResources", - "cloudformation:UpdateStack" - ], - "Resource": [ - "arn:aws:cloudformation:us-east-1:111122223333:stack/stack-name" - ] - }, - { - "Sid": "S3", - "Effect": "Allow", - "Action": [ - "s3:CreateBucket", - "s3:GetObject", - "s3:PutObject" - ], - "Resource": [ - "arn:aws:s3:::name-of-bucket/key-name" - ] - }, - { - "Sid": "ECRRepository", - "Effect": "Allow", - "Action": [ - "ecr:BatchCheckLayerAvailability", - "ecr:BatchGetImage", - "ecr:CompleteLayerUpload", - "ecr:CreateRepository", - "ecr:DeleteRepository", - "ecr:DescribeImages", - "ecr:DescribeRepositories", - "ecr:GetDownloadUrlForLayer", - "ecr:GetRepositoryPolicy", - "ecr:InitiateLayerUpload", - "ecr:ListImages", - "ecr:PutImage", - "ecr:SetRepositoryPolicy", - "ecr:UploadLayerPart" - ], - "Resource": [ - "arn:aws:ecr:us-east-1:111122223333:repository/repository-name" - ] - }, - { - "Sid": "ECRAuthToken", - "Effect": "Allow", - "Action": [ - "ecr:GetAuthorizationToken" - ], - "Resource": [ - "arn:aws:ecr:us-east-1:111122223333:repository/repository-name" - ] - }, - { - "Sid": "Lambda", - "Effect": "Allow", - "Action": [ - "lambda:AddPermission", - "lambda:CreateFunction", - "lambda:DeleteFunction", - "lambda:GetFunction", - "lambda:GetFunctionConfiguration", - "lambda:ListTags", - "lambda:RemovePermission", - "lambda:TagResource", - "lambda:UntagResource", - "lambda:UpdateFunctionCode", - "lambda:UpdateFunctionConfiguration" - ], - "Resource": [ - "arn:aws:lambda:us-east-1:111122223333:function/function-name" - ] - }, - { - "Sid": "IAM", - "Effect": "Allow", - "Action": [ - "iam:CreateRole", - "iam:AttachRolePolicy", - "iam:DeleteRole", - "iam:DetachRolePolicy", - "iam:GetRole", - "iam:TagRole" - ], - "Resource": [ - "arn:aws:iam::111122223333:role/role-name" - ] - }, - { - "Sid": "IAMPassRole", - "Effect": "Allow", - "Action": "iam:PassRole", - "Resource": "arn:aws:iam::111122223333:role/role-name", - "Condition": { - "StringEquals": { - "iam:PassedToService": "lambda.amazonaws.com" - } - } - }, - { - "Sid": "APIGateway", - "Effect": "Allow", - "Action": [ - "apigateway:DELETE", - "apigateway:GET", - "apigateway:PATCH", - "apigateway:POST", - "apigateway:PUT" - ], - "Resource": [ - "arn:aws:apigateway:us-east-1:api-id:resource-path" - ] - } - ] - } - -