abundant-hair-53100
09/13/2022, 7:22 AMconst confirmUserIamRolePolicy = new aws.iam.Policy(
'confirm-user-signup-role-policy',
{
policy: JSON.stringify({
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: [DBAction.Put],
Resource: usersTable.arn.apply((arn) => `${arn}`),
},
],
}),
}
)
export const confirmUserIamRole = new aws.iam.Role('confirm-user-signup-role', {
assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({
Service: '<http://lambda.amazonaws.com|lambda.amazonaws.com>',
}),
managedPolicyArns: [confirmUserIamRolePolicy.arn],
})
const confirmUserIamRolePolicyAttachment = new aws.iam.PolicyAttachment(
'confirm-user-signup-role-policy-attachment',
{
policyArn: confirmUserIamRolePolicy.arn,
roles: [confirmUserIamRole],
}
)
export const postConfirmationLambda = new aws.lambda.CallbackFunction(
'post-confirmation-signup-lambda',
{
runtime: 'nodejs14.x',
callback: confirmUserSignupHandler,
role: confirmUserIamRole,
environment: {
variables: {
USERS_TABLE: usersTable.name,
REGION: region,
},
},
}
)
Resource: '*'
but I don’t want that. And I think the arn is not resolved at the time of execution for the Policy. Is this correct?millions-furniture-75402
09/13/2022, 12:52 PMAction: [DBAction.Put]
?confirmUserIamRolePolicy
's arnpulumi.interpolate`${usersTable.arn}`,
new aws.iam.RolePolicyAttachment(
`${appName}-lambda-role-attachment`,
{
role: applicationRole,
policyArn: new aws.iam.Policy(`${appName}-lambda-policy`, {
policy: {
Version: "2012-10-17",
Statement: [
{
Sid: "DynamoDBCrud",
Effect: "Allow",
Action: [
"dynamodb:GetItem",
"dynamodb:DeleteItem",
"dynamodb:PutItem",
"dynamodb:Scan",
"dynamodb:Query",
"dynamodb:UpdateItem",
"dynamodb:BatchWriteItem",
"dynamodb:BatchGetItem",
"dynamodb:DescribeTable",
"dynamodb:ConditionCheckItem",
],
Resource: [
pulumi.interpolate`${eventTransactionsDdbTableArn}`,
pulumi.interpolate`${eventTransactionsDdbTableArn}/index/*`,
]
abundant-hair-53100
09/13/2022, 2:52 PM