Skip to content

Commit 7f4a4b2

Browse files
author
Yuriy Bezsonov
committed
fix(infra): refine IAM policy
1 parent 119ef9c commit 7f4a4b2

7 files changed

Lines changed: 159 additions & 133 deletions

File tree

‎infra/cdk/src/main/resources/iam-policy.json‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,17 @@
7373
"Sid": "CreateServiceLinkedRole",
7474
"Effect": "Allow",
7575
"Action": [
76-
"iam:CreateServiceLinkedRole",
76+
"iam:CreateServiceLinkedRole"
77+
],
78+
"Resource": [
79+
"arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/*",
80+
"arn:aws:iam::*:role/aws-service-role/cloudtrail.amazonaws.com/*"
81+
]
82+
},
83+
{
84+
"Sid": "GetRole",
85+
"Effect": "Allow",
86+
"Action": [
7787
"iam:GetRole"
7888
],
7989
"Resource": "*"

‎infra/cfn/base-stack.yaml‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -677,30 +677,6 @@ Resources:
677677
- IdeInstanceLauncherFunction803C5A2A
678678
- Arn
679679
InstanceTypes: m6a.xlarge,m7a.xlarge
680-
InstanceName: ide
681-
IamInstanceProfileArn:
682-
Fn::GetAtt:
683-
- IdeInstanceProfile61B92038
684-
- Arn
685-
VolumeSize: "50"
686-
SubnetIds:
687-
Fn::Join:
688-
- ""
689-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
690-
- ","
691-
- Ref: VpcPublicSubnet2SubnetA811849C
692-
SecurityGroupIds:
693-
Fn::Join:
694-
- ""
695-
- - Fn::GetAtt:
696-
- IdeSecurityGroup73B02454
697-
- GroupId
698-
- ","
699-
- Fn::GetAtt:
700-
- IdeInternalSecurityGroupB0A5D76B
701-
- GroupId
702-
ImageId:
703-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
704680
UserData:
705681
Fn::Base64:
706682
Fn::Join:
@@ -837,6 +813,30 @@ Resources:
837813
"
838814
exit 1
839815
fi
816+
ImageId:
817+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
818+
SecurityGroupIds:
819+
Fn::Join:
820+
- ""
821+
- - Fn::GetAtt:
822+
- IdeSecurityGroup73B02454
823+
- GroupId
824+
- ","
825+
- Fn::GetAtt:
826+
- IdeInternalSecurityGroupB0A5D76B
827+
- GroupId
828+
SubnetIds:
829+
Fn::Join:
830+
- ""
831+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
832+
- ","
833+
- Ref: VpcPublicSubnet2SubnetA811849C
834+
VolumeSize: "50"
835+
IamInstanceProfileArn:
836+
Fn::GetAtt:
837+
- IdeInstanceProfile61B92038
838+
- Arn
839+
InstanceName: ide
840840
UpdateReplacePolicy: Delete
841841
DeletionPolicy: Delete
842842
IdeEipAssociationDFF81215:

‎infra/cfn/java-ai-agents-stack.yaml‎

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -394,12 +394,16 @@ Resources:
394394
- !Sub arn:aws:iam::${AWS::AccountId}:role/unicorn*
395395
- !Sub arn:aws:iam::${AWS::AccountId}:role/workshop-*
396396
Sid: PassRole
397-
- Action:
398-
- iam:CreateServiceLinkedRole
399-
- iam:GetRole
397+
- Action: iam:CreateServiceLinkedRole
400398
Effect: Allow
401-
Resource: "*"
399+
Resource:
400+
- arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/*
401+
- arn:aws:iam::*:role/aws-service-role/cloudtrail.amazonaws.com/*
402402
Sid: CreateServiceLinkedRole
403+
- Action: iam:GetRole
404+
Effect: Allow
405+
Resource: "*"
406+
Sid: GetRole
403407
- Action: ec2:RunInstances
404408
Condition:
405409
StringLike:
@@ -768,27 +772,6 @@ Resources:
768772
Fn::GetAtt:
769773
- IdeInstanceLauncherFunction803C5A2A
770774
- Arn
771-
IamInstanceProfileArn:
772-
Fn::GetAtt:
773-
- IdeInstanceProfile61B92038
774-
- Arn
775-
VolumeSize: "50"
776-
SubnetIds:
777-
Fn::Join:
778-
- ""
779-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
780-
- ","
781-
- Ref: VpcPublicSubnet2SubnetA811849C
782-
SecurityGroupIds:
783-
Fn::Join:
784-
- ""
785-
- - Fn::GetAtt:
786-
- IdeSecurityGroup73B02454
787-
- GroupId
788-
- ","
789-
- Fn::GetAtt:
790-
- IdeInternalSecurityGroupB0A5D76B
791-
- GroupId
792775
ImageId:
793776
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
794777
UserData:
@@ -929,6 +912,27 @@ Resources:
929912
fi
930913
InstanceTypes: m6a.xlarge,m7a.xlarge
931914
InstanceName: ide
915+
IamInstanceProfileArn:
916+
Fn::GetAtt:
917+
- IdeInstanceProfile61B92038
918+
- Arn
919+
VolumeSize: "50"
920+
SubnetIds:
921+
Fn::Join:
922+
- ""
923+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
924+
- ","
925+
- Ref: VpcPublicSubnet2SubnetA811849C
926+
SecurityGroupIds:
927+
Fn::Join:
928+
- ""
929+
- - Fn::GetAtt:
930+
- IdeSecurityGroup73B02454
931+
- GroupId
932+
- ","
933+
- Fn::GetAtt:
934+
- IdeInternalSecurityGroupB0A5D76B
935+
- GroupId
932936
UpdateReplacePolicy: Delete
933937
DeletionPolicy: Delete
934938
IdeEipAssociationDFF81215:

‎infra/cfn/java-on-amazon-eks-stack.yaml‎

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -414,12 +414,16 @@ Resources:
414414
- !Sub arn:aws:iam::${AWS::AccountId}:role/unicorn*
415415
- !Sub arn:aws:iam::${AWS::AccountId}:role/workshop-*
416416
Sid: PassRole
417-
- Action:
418-
- iam:CreateServiceLinkedRole
419-
- iam:GetRole
417+
- Action: iam:CreateServiceLinkedRole
420418
Effect: Allow
421-
Resource: "*"
419+
Resource:
420+
- arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/*
421+
- arn:aws:iam::*:role/aws-service-role/cloudtrail.amazonaws.com/*
422422
Sid: CreateServiceLinkedRole
423+
- Action: iam:GetRole
424+
Effect: Allow
425+
Resource: "*"
426+
Sid: GetRole
423427
- Action: ec2:RunInstances
424428
Condition:
425429
StringLike:
@@ -788,11 +792,6 @@ Resources:
788792
Fn::GetAtt:
789793
- IdeInstanceLauncherFunction803C5A2A
790794
- Arn
791-
IamInstanceProfileArn:
792-
Fn::GetAtt:
793-
- IdeInstanceProfile61B92038
794-
- Arn
795-
InstanceName: ide
796795
InstanceTypes: m6a.xlarge,m7a.xlarge
797796
UserData:
798797
Fn::Base64:
@@ -949,6 +948,11 @@ Resources:
949948
- ","
950949
- Ref: VpcPublicSubnet2SubnetA811849C
951950
VolumeSize: "50"
951+
IamInstanceProfileArn:
952+
Fn::GetAtt:
953+
- IdeInstanceProfile61B92038
954+
- Arn
955+
InstanceName: ide
952956
UpdateReplacePolicy: Delete
953957
DeletionPolicy: Delete
954958
IdeEipAssociationDFF81215:
@@ -1327,12 +1331,12 @@ Resources:
13271331
Environment:
13281332
ComputeType: BUILD_GENERAL1_MEDIUM
13291333
EnvironmentVariables:
1330-
- Name: GIT_BRANCH
1331-
Type: PLAINTEXT
1332-
Value: new-ws-infra
13331334
- Name: TEMPLATE_TYPE
13341335
Type: PLAINTEXT
13351336
Value: java-on-amazon-eks
1337+
- Name: GIT_BRANCH
1338+
Type: PLAINTEXT
1339+
Value: new-ws-infra
13361340
Image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
13371341
ImagePullCredentialsType: CODEBUILD
13381342
PrivilegedMode: false
@@ -1574,7 +1578,7 @@ Resources:
15741578
Fn::GetAtt:
15751579
- CodeBuildStartLambdaFunction8349284F
15761580
- Arn
1577-
ContentHash: "1767104254998"
1581+
ContentHash: "1767112676831"
15781582
CodeBuildIamRoleArn:
15791583
Fn::GetAtt:
15801584
- CodeBuildRoleE9A44575
@@ -1938,7 +1942,7 @@ Resources:
19381942
- Ref: AWS::AccountId
19391943
- "-"
19401944
- Ref: AWS::Region
1941-
- "-20251230151735"
1945+
- "-20251230173757"
19421946
PublicAccessBlockConfiguration:
19431947
BlockPublicAcls: true
19441948
BlockPublicPolicy: true
@@ -2205,12 +2209,12 @@ Resources:
22052209
}
22062210
Environment:
22072211
Variables:
2208-
S3_THREAD_DUMPS_PREFIX: thread-dumps/
22092212
S3_BUCKET_NAME:
22102213
Ref: WorkshopBucketFD5BC43F
22112214
EKS_CLUSTER_NAME:
22122215
Ref: EksClusterB2BDED5B
22132216
SECRET_NAME: workshop-ide-password
2217+
S3_THREAD_DUMPS_PREFIX: thread-dumps/
22142218
FunctionName: workshop-thread-dump-lambda
22152219
Handler: index.lambda_handler
22162220
MemorySize: 512

‎infra/cfn/java-on-aws-immersion-day-stack.yaml‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -414,12 +414,16 @@ Resources:
414414
- !Sub arn:aws:iam::${AWS::AccountId}:role/unicorn*
415415
- !Sub arn:aws:iam::${AWS::AccountId}:role/workshop-*
416416
Sid: PassRole
417-
- Action:
418-
- iam:CreateServiceLinkedRole
419-
- iam:GetRole
417+
- Action: iam:CreateServiceLinkedRole
420418
Effect: Allow
421-
Resource: "*"
419+
Resource:
420+
- arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/*
421+
- arn:aws:iam::*:role/aws-service-role/cloudtrail.amazonaws.com/*
422422
Sid: CreateServiceLinkedRole
423+
- Action: iam:GetRole
424+
Effect: Allow
425+
Resource: "*"
426+
Sid: GetRole
423427
- Action: ec2:RunInstances
424428
Condition:
425429
StringLike:
@@ -788,18 +792,6 @@ Resources:
788792
Fn::GetAtt:
789793
- IdeInstanceLauncherFunction803C5A2A
790794
- Arn
791-
InstanceName: ide
792-
IamInstanceProfileArn:
793-
Fn::GetAtt:
794-
- IdeInstanceProfile61B92038
795-
- Arn
796-
VolumeSize: "50"
797-
SubnetIds:
798-
Fn::Join:
799-
- ""
800-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
801-
- ","
802-
- Ref: VpcPublicSubnet2SubnetA811849C
803795
SecurityGroupIds:
804796
Fn::Join:
805797
- ""
@@ -810,8 +802,19 @@ Resources:
810802
- Fn::GetAtt:
811803
- IdeInternalSecurityGroupB0A5D76B
812804
- GroupId
813-
ImageId:
814-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
805+
SubnetIds:
806+
Fn::Join:
807+
- ""
808+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
809+
- ","
810+
- Ref: VpcPublicSubnet2SubnetA811849C
811+
VolumeSize: "50"
812+
IamInstanceProfileArn:
813+
Fn::GetAtt:
814+
- IdeInstanceProfile61B92038
815+
- Arn
816+
InstanceName: ide
817+
InstanceTypes: m6a.xlarge,m7a.xlarge
815818
UserData:
816819
Fn::Base64:
817820
Fn::Join:
@@ -948,7 +951,8 @@ Resources:
948951
"
949952
exit 1
950953
fi
951-
InstanceTypes: m6a.xlarge,m7a.xlarge
954+
ImageId:
955+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
952956
UpdateReplacePolicy: Delete
953957
DeletionPolicy: Delete
954958
IdeEipAssociationDFF81215:
@@ -1327,12 +1331,12 @@ Resources:
13271331
Environment:
13281332
ComputeType: BUILD_GENERAL1_MEDIUM
13291333
EnvironmentVariables:
1330-
- Name: GIT_BRANCH
1331-
Type: PLAINTEXT
1332-
Value: new-ws-infra
13331334
- Name: TEMPLATE_TYPE
13341335
Type: PLAINTEXT
13351336
Value: java-on-aws-immersion-day
1337+
- Name: GIT_BRANCH
1338+
Type: PLAINTEXT
1339+
Value: new-ws-infra
13361340
Image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
13371341
ImagePullCredentialsType: CODEBUILD
13381342
PrivilegedMode: false
@@ -1574,13 +1578,13 @@ Resources:
15741578
Fn::GetAtt:
15751579
- CodeBuildStartLambdaFunction8349284F
15761580
- Arn
1577-
ProjectName:
1578-
Ref: CodeBuildProjectA0FF5539
15791581
CodeBuildIamRoleArn:
15801582
Fn::GetAtt:
15811583
- CodeBuildRoleE9A44575
15821584
- Arn
1583-
ContentHash: "1767104246264"
1585+
ProjectName:
1586+
Ref: CodeBuildProjectA0FF5539
1587+
ContentHash: "1767112658062"
15841588
DependsOn:
15851589
- CodeBuildCompleteRuleAllowEventRuleWorkshopStackCodeBuildReportLambdaFunctionD77C60919E0B0C89
15861590
- CodeBuildCompleteRuleEE9277E8
@@ -1938,7 +1942,7 @@ Resources:
19381942
- Ref: AWS::AccountId
19391943
- "-"
19401944
- Ref: AWS::Region
1941-
- "-20251230151726"
1945+
- "-20251230173738"
19421946
PublicAccessBlockConfiguration:
19431947
BlockPublicAcls: true
19441948
BlockPublicPolicy: true
@@ -2205,12 +2209,12 @@ Resources:
22052209
}
22062210
Environment:
22072211
Variables:
2212+
S3_THREAD_DUMPS_PREFIX: thread-dumps/
22082213
S3_BUCKET_NAME:
22092214
Ref: WorkshopBucketFD5BC43F
2210-
S3_THREAD_DUMPS_PREFIX: thread-dumps/
2211-
SECRET_NAME: workshop-ide-password
22122215
EKS_CLUSTER_NAME:
22132216
Ref: EksClusterB2BDED5B
2217+
SECRET_NAME: workshop-ide-password
22142218
FunctionName: workshop-thread-dump-lambda
22152219
Handler: index.lambda_handler
22162220
MemorySize: 512
@@ -2787,6 +2791,9 @@ Resources:
27872791
Fn::GetAtt:
27882792
- UnicornUnicornStoreDatabaseSetupFunction04E12F8B
27892793
- Arn
2794+
SqlStatements: |
2795+
CREATE TABLE IF NOT EXISTS unicorns(id TEXT DEFAULT gen_random_uuid() PRIMARY KEY, name TEXT, age TEXT, size TEXT, type TEXT);
2796+
CREATE EXTENSION IF NOT EXISTS vector;
27902797
SecretName:
27912798
Fn::Join:
27922799
- "-"
@@ -2817,9 +2824,6 @@ Resources:
28172824
- Fn::Split:
28182825
- ":"
28192826
- Ref: DatabaseSecret3B817195
2820-
SqlStatements: |
2821-
CREATE TABLE IF NOT EXISTS unicorns(id TEXT DEFAULT gen_random_uuid() PRIMARY KEY, name TEXT, age TEXT, size TEXT, type TEXT);
2822-
CREATE EXTENSION IF NOT EXISTS vector;
28232827
DependsOn:
28242828
- DatabaseClusterDatabaseWriterF4C0B9A6
28252829
- DatabaseCluster5B53A178

0 commit comments

Comments
 (0)