Add product CRUD, IAM action buttons, and API Gateway IAM role

Products:
- POST /products and DELETE /products/{product_id} Lambda handlers
- Matching API Gateway routes and DynamoDB PutItem/DeleteItem permissions
- UI: add product form and per-row delete button in Products section

IAM section UI:
- Enable/Disable Enforcement buttons (call /_aws/iam/config)
- Grant/Revoke PutItem buttons (proxy through POST /iam/fix and /iam/revoke Lambda endpoints)

Terraform:
- apigw-exec-role with identity-based lambda:InvokeFunction policy
- credentials field on all API Gateway integrations so LocalStack IAM enforcement sees an explicit allow for API Gateway → Lambda calls
- Makefile: save-state and load-state targets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: whummer

01-serverless-app/lambdas/order_handler/handler.py

@@ -7,6 +7,7 @@
 
 dynamodb = boto3.resource("dynamodb")
 sqs = boto3.client("sqs")
+iam = boto3.client("iam")
 
 TABLE_NAME     = os.environ["ORDERS_TABLE"]
 PRODUCTS_TABLE = os.environ["PRODUCTS_TABLE"]
@@ -21,7 +22,7 @@ def default(self, o):
 CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Headers": "Content-Type",
-    "Access-Control-Allow-Methods": "GET,POST,OPTIONS",
+    "Access-Control-Allow-Methods": "GET,POST,DELETE,OPTIONS",
 }
 
 
@@ -35,9 +36,18 @@ def handler(event, context):
     if method == "POST" and path.endswith("/replay"):
         return replay_dlq()
 
+    if "/iam/" in path:
+        return iam_action(method, path)
+
     if method == "GET" and "/products" in path:
         return list_products()
 
+    if method == "POST" and "/products" in path:
+        return create_product(event)
+
+    if method == "DELETE" and "/products" in path:
+        return delete_product(event)
+
     if method == "GET":
         return list_orders()
 
@@ -70,6 +80,61 @@ def list_products():
     }
 
 
+def create_product(event):
+    body = json.loads(event.get("body") or "{}")
+    product_id = body.get("product_id") or uuid.uuid4().hex[:12]
+    product = {
+        "product_id": product_id,
+        "name":        body.get("name", ""),
+        "description": body.get("description", ""),
+        "price":       Decimal(str(body.get("price", "0"))),
+    }
+    dynamodb.Table(PRODUCTS_TABLE).put_item(Item=product)
+    return {
+        "statusCode": 201,
+        "headers": {**CORS_HEADERS, "Content-Type": "application/json"},
+        "body": json.dumps({"product_id": product_id}),
+    }
+
+
+def iam_action(method, path):
+    ROLE = "lambda-exec-role"
+    POLICY_NAME = "order-handler-putitem"
+    POLICY_DOC = json.dumps({
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Effect": "Allow",
+            "Action": ["dynamodb:PutItem"],
+            "Resource": "*",
+        }],
+    })
+    try:
+        if path.endswith("/fix"):
+            iam.put_role_policy(RoleName=ROLE, PolicyName=POLICY_NAME, PolicyDocument=POLICY_DOC)
+            return {"statusCode": 200, "headers": {**CORS_HEADERS, "Content-Type": "application/json"},
+                    "body": json.dumps({"result": "granted"})}
+        if path.endswith("/revoke"):
+            iam.delete_role_policy(RoleName=ROLE, PolicyName=POLICY_NAME)
+            return {"statusCode": 200, "headers": {**CORS_HEADERS, "Content-Type": "application/json"},
+                    "body": json.dumps({"result": "revoked"})}
+    except Exception as e:
+        return {"statusCode": 500, "headers": {**CORS_HEADERS, "Content-Type": "application/json"},
+                "body": json.dumps({"error": str(e)})}
+    return {"statusCode": 404, "headers": CORS_HEADERS, "body": "Not found"}
+
+
+def delete_product(event):
+    product_id = (event.get("pathParameters") or {}).get("product_id")
+    if not product_id:
+        return {"statusCode": 400, "headers": CORS_HEADERS, "body": "Missing product_id"}
+    dynamodb.Table(PRODUCTS_TABLE).delete_item(Key={"product_id": product_id})
+    return {
+        "statusCode": 200,
+        "headers": {**CORS_HEADERS, "Content-Type": "application/json"},
+        "body": json.dumps({"deleted": product_id}),
+    }
+
+
 def list_orders():
     table = dynamodb.Table(TABLE_NAME)
     result = table.scan()

01-serverless-app/terraform/main.tf

@@ -181,6 +181,32 @@ resource "aws_sqs_queue" "orders" {
 
 # ── IAM ───────────────────────────────────────────────────────────────────────
 
+resource "aws_iam_role" "apigw_exec" {
+  name = "apigw-exec-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action    = "sts:AssumeRole"
+      Effect    = "Allow"
+      Principal = { Service = "apigateway.amazonaws.com" }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "apigw_invoke_lambda" {
+  role = aws_iam_role.apigw_exec.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = "lambda:InvokeFunction"
+      Resource = aws_lambda_function.order_handler.arn
+    }]
+  })
+}
+
 resource "aws_iam_role" "lambda_exec" {
   name = "lambda-exec-role"
 
@@ -201,11 +227,21 @@ resource "aws_iam_role_policy" "lambda_policy" {
     Version = "2012-10-17"
     Statement = [
       {
-        # dynamodb:PutItem intentionally omitted — see 03-iam-enforcement for the IAM demo
+        # dynamodb:PutItem intentionally omitted for orders — see 03-iam-enforcement for the IAM demo
         Effect   = "Allow"
         Action   = ["dynamodb:UpdateItem", "dynamodb:GetItem", "dynamodb:Scan"]
         Resource = [aws_dynamodb_table.orders.arn, aws_dynamodb_table.products.arn]
       },
+      {
+        Effect   = "Allow"
+        Action   = ["dynamodb:PutItem", "dynamodb:DeleteItem"]
+        Resource = aws_dynamodb_table.products.arn
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["iam:PutRolePolicy", "iam:DeleteRolePolicy"]
+        Resource = aws_iam_role.lambda_exec.arn
+      },
       {
         Effect   = "Allow"
         Action   = ["sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"]
@@ -448,6 +484,7 @@ resource "aws_api_gateway_integration" "post_order_handler" {
   http_method             = aws_api_gateway_method.post_order.http_method
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
   uri                     = aws_lambda_function.order_handler.invoke_arn
 }
 
@@ -457,6 +494,7 @@ resource "aws_api_gateway_integration" "get_orders_handler" {
   http_method             = aws_api_gateway_method.get_orders.http_method
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
   uri                     = aws_lambda_function.order_handler.invoke_arn
 }
 
@@ -466,6 +504,7 @@ resource "aws_api_gateway_integration" "options_order_handler" {
   http_method             = aws_api_gateway_method.options_orders.http_method
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
   uri                     = aws_lambda_function.order_handler.invoke_arn
 }
 
@@ -495,6 +534,7 @@ resource "aws_api_gateway_integration" "get_products_handler" {
   http_method             = aws_api_gateway_method.get_products.http_method
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
   uri                     = aws_lambda_function.order_handler.invoke_arn
 }
 
@@ -504,6 +544,116 @@ resource "aws_api_gateway_integration" "options_products_handler" {
   http_method             = aws_api_gateway_method.options_products.http_method
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
+  uri                     = aws_lambda_function.order_handler.invoke_arn
+}
+
+resource "aws_api_gateway_method" "post_product" {
+  rest_api_id   = aws_api_gateway_rest_api.orders_api.id
+  resource_id   = aws_api_gateway_resource.products.id
+  http_method   = "POST"
+  authorization = "NONE"
+}
+
+resource "aws_api_gateway_integration" "post_product_handler" {
+  rest_api_id             = aws_api_gateway_rest_api.orders_api.id
+  resource_id             = aws_api_gateway_resource.products.id
+  http_method             = aws_api_gateway_method.post_product.http_method
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
+  uri                     = aws_lambda_function.order_handler.invoke_arn
+}
+
+resource "aws_api_gateway_resource" "product_id" {
+  rest_api_id = aws_api_gateway_rest_api.orders_api.id
+  parent_id   = aws_api_gateway_resource.products.id
+  path_part   = "{product_id}"
+}
+
+resource "aws_api_gateway_method" "delete_product" {
+  rest_api_id   = aws_api_gateway_rest_api.orders_api.id
+  resource_id   = aws_api_gateway_resource.product_id.id
+  http_method   = "DELETE"
+  authorization = "NONE"
+}
+
+resource "aws_api_gateway_integration" "delete_product_handler" {
+  rest_api_id             = aws_api_gateway_rest_api.orders_api.id
+  resource_id             = aws_api_gateway_resource.product_id.id
+  http_method             = aws_api_gateway_method.delete_product.http_method
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
+  uri                     = aws_lambda_function.order_handler.invoke_arn
+}
+
+resource "aws_api_gateway_method" "options_product_id" {
+  rest_api_id   = aws_api_gateway_rest_api.orders_api.id
+  resource_id   = aws_api_gateway_resource.product_id.id
+  http_method   = "OPTIONS"
+  authorization = "NONE"
+}
+
+resource "aws_api_gateway_integration" "options_product_id_handler" {
+  rest_api_id             = aws_api_gateway_rest_api.orders_api.id
+  resource_id             = aws_api_gateway_resource.product_id.id
+  http_method             = aws_api_gateway_method.options_product_id.http_method
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
+  uri                     = aws_lambda_function.order_handler.invoke_arn
+}
+
+resource "aws_api_gateway_resource" "iam" {
+  rest_api_id = aws_api_gateway_rest_api.orders_api.id
+  parent_id   = aws_api_gateway_rest_api.orders_api.root_resource_id
+  path_part   = "iam"
+}
+
+resource "aws_api_gateway_resource" "iam_fix" {
+  rest_api_id = aws_api_gateway_rest_api.orders_api.id
+  parent_id   = aws_api_gateway_resource.iam.id
+  path_part   = "fix"
+}
+
+resource "aws_api_gateway_method" "post_iam_fix" {
+  rest_api_id   = aws_api_gateway_rest_api.orders_api.id
+  resource_id   = aws_api_gateway_resource.iam_fix.id
+  http_method   = "POST"
+  authorization = "NONE"
+}
+
+resource "aws_api_gateway_integration" "post_iam_fix_handler" {
+  rest_api_id             = aws_api_gateway_rest_api.orders_api.id
+  resource_id             = aws_api_gateway_resource.iam_fix.id
+  http_method             = aws_api_gateway_method.post_iam_fix.http_method
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
+  uri                     = aws_lambda_function.order_handler.invoke_arn
+}
+
+resource "aws_api_gateway_resource" "iam_revoke" {
+  rest_api_id = aws_api_gateway_rest_api.orders_api.id
+  parent_id   = aws_api_gateway_resource.iam.id
+  path_part   = "revoke"
+}
+
+resource "aws_api_gateway_method" "post_iam_revoke" {
+  rest_api_id   = aws_api_gateway_rest_api.orders_api.id
+  resource_id   = aws_api_gateway_resource.iam_revoke.id
+  http_method   = "POST"
+  authorization = "NONE"
+}
+
+resource "aws_api_gateway_integration" "post_iam_revoke_handler" {
+  rest_api_id             = aws_api_gateway_rest_api.orders_api.id
+  resource_id             = aws_api_gateway_resource.iam_revoke.id
+  http_method             = aws_api_gateway_method.post_iam_revoke.http_method
+  integration_http_method = "POST"
+  type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
   uri                     = aws_lambda_function.order_handler.invoke_arn
 }
 
@@ -533,6 +683,7 @@ resource "aws_api_gateway_integration" "post_replay_handler" {
   http_method             = aws_api_gateway_method.post_replay.http_method
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
   uri                     = aws_lambda_function.order_handler.invoke_arn
 }
 
@@ -542,6 +693,7 @@ resource "aws_api_gateway_integration" "options_replay_handler" {
   http_method             = aws_api_gateway_method.options_replay.http_method
   integration_http_method = "POST"
   type                    = "AWS_PROXY"
+  credentials             = aws_iam_role.apigw_exec.arn
   uri                     = aws_lambda_function.order_handler.invoke_arn
 }
 
@@ -565,6 +717,11 @@ resource "aws_api_gateway_deployment" "orders_api" {
       aws_api_gateway_integration.options_replay_handler.id,
       aws_api_gateway_integration.get_products_handler.id,
       aws_api_gateway_integration.options_products_handler.id,
+      aws_api_gateway_integration.post_product_handler.id,
+      aws_api_gateway_integration.delete_product_handler.id,
+      aws_api_gateway_integration.options_product_id_handler.id,
+      aws_api_gateway_integration.post_iam_fix_handler.id,
+      aws_api_gateway_integration.post_iam_revoke_handler.id,
     ]))
   }
 
@@ -576,6 +733,11 @@ resource "aws_api_gateway_deployment" "orders_api" {
     aws_api_gateway_integration.options_replay_handler,
     aws_api_gateway_integration.get_products_handler,
     aws_api_gateway_integration.options_products_handler,
+    aws_api_gateway_integration.post_product_handler,
+    aws_api_gateway_integration.delete_product_handler,
+    aws_api_gateway_integration.options_product_id_handler,
+    aws_api_gateway_integration.post_iam_fix_handler,
+    aws_api_gateway_integration.post_iam_revoke_handler,
   ]
 }