.iam.md

IAM Policy Guide

Table of Contents

• README.md: sendgrid-eventkit-lambda-mongodb

• Table of Contents

  • Process
  • Description
  • IAM Account/Action specific values
  • IAM User
  • Policy ARN
  • Policy justification
    • CreateFunctions
    • DeployCode
    • SetRole
  • Example Policy

Description

• Provide access to Travis user for Lambda function deployment.

Process

1. Create IAM policy using the below details with the lambda_basic_execution role.
2. Create IAM user for Travis user and attach the new policy

IAM Account/Action specific values

 - <region> (eu-west-1, us-east-1, us-west-2....)
 - <account-id> (your amazon account-id)
 - <name-of-function> (target functon name e.g. sendgrid-eventkit)
 - <name-of-role> (name of role you create e.g. travis-lambda)

IAM User

- a_user_name: <aws:user>
- access_key: <aws-access-token>
- secret_key: <aws-secret-token>

Policy ARN

arn:aws:iam::<account-id>:policy/<name-of-role>

Policy justification

CreateFunctions

The following can not be targeted at a specific resource.

lambda:ListFunctions

• Required if AWS is to make functions that don't exists. If you create a placeholder function first you could drop this.

lambda:CreateFunction

• Required to create and edit lambda functions

DeployCode

Targeted at the specific resource that you are creating,editing or configuring

lambda:GetFunction

lambda:UpdateFunctionCode

lambda:UpdateFunctionConfiguration

- Required to interact lambda functions

SetRole

Example Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CreateFunctions",
            "Effect": "Allow",
            "Action": [
                "lambda:CreateFunction",
                "lambda:ListFunctions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DeployCode",
            "Effect": "Allow",
            "Action": [
                "lambda:GetFunction",
                "lambda:UpdateFunctionCode",
                "lambda:UpdateFunctionConfiguration"
            ],
            "Resource": [
                "arn:aws:lambda:<region>:<account-id>:function:<name-of-function>"
            ]
        },
        {
            "Sid": "SetRole",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::<account-id>:role/lambda_basic_execution"
            ]
        }
    ]
}