@aws-cdk/aws-iam
Advanced tools
Changelog
0.10.0 (2018-09-27)
This release introduces a better way to "escape" L2 constructs in case of missing features by adding the ability to add arbitrary overrides for resource properties:
const bucket = new s3.Bucket(this, 'L2Bucket');
// access L1
const bucketResource = bucket.findChild('Resource') as s3.cloudformation.BucketResource;
// strongly-typed overrides
bucketResource.propertyOverrides.bucketName = 'NewBucketName';
// weakly-typed overrides
bucketResource.addPropertyOverride('BucketName', 'NewerBucketName');
TagManager has changed. initialTags is now passed inside a props object.@aws-cdk/util is no longer available@aws-cdk/cfnspec: Updated [CloudFormation resource specification] to v2.8.0 ([@RomainMuller] in #767)
New Construct Libraries
@aws-cdk/aws-amazonmq@aws-cdk/aws-iot1clickNew Resource Types
Attribute Changes
Property Changes
AWS::ApiGateway::Deployment DeploymentCanarySettings (added)
AWS::ApiGateway::Method AuthorizationScopes (added)
AWS::ApiGateway::Stage AccessLogSetting (added)
AWS::ApiGateway::Stage CanarySetting (added)
AWS::AutoScaling::AutoScalingGroup LaunchTemplate (added)
AWS::CodeBuild::Project LogsConfig (added)
AWS::CodeBuild::Project SecondaryArtifacts (added)
AWS::CodeBuild::Project SecondarySources (added)
AWS::CodeDeploy::DeploymentGroup Ec2TagSet (added)
AWS::CodeDeploy::DeploymentGroup OnPremisesTagSet (added)
AWS::EC2::FlowLog LogDestination (added)
AWS::EC2::FlowLog LogDestinationType (added)
AWS::EC2::FlowLog DeliverLogsPermissionArn.Required (changed)
AWS::EC2::FlowLog LogGroupName.Required (changed)
AWS::EC2::VPCEndpoint IsPrivateDnsEnabled (deleted)
AWS::EC2::VPCEndpoint PrivateDnsEnabled (added)
AWS::EC2::VPCEndpoint RouteTableIds.DuplicatesAllowed (added)
AWS::EC2::VPCEndpoint SecurityGroupIds.DuplicatesAllowed (added)
AWS::EC2::VPCEndpoint SubnetIds.DuplicatesAllowed (added)
AWS::EC2::VPCEndpoint VPCEndpointType.UpdateType (changed)
AWS::ECS::Service SchedulingStrategy (added)
AWS::ECS::Service ServiceRegistries.UpdateType (changed)
AWS::ElastiCache::ReplicationGroup NodeGroupConfiguration.UpdateType (changed)
AWS::ElastiCache::ReplicationGroup NumNodeGroups.UpdateType (changed)
AWS::RDS::DBCluster EngineMode (added)
AWS::RDS::DBCluster ScalingConfiguration (added)
AWS::SageMaker::NotebookInstance LifecycleConfigName.UpdateType (changed)
Property Type Changes
AWS::ApiGateway::Deployment.AccessLogSetting (added)
AWS::ApiGateway::Deployment.CanarySetting (added)
AWS::ApiGateway::Deployment.DeploymentCanarySettings (added)
AWS::ApiGateway::Stage.AccessLogSetting (added)
AWS::ApiGateway::Stage.CanarySetting (added)
AWS::AutoScaling::AutoScalingGroup.LaunchTemplateSpecification (added)
AWS::CodeBuild::Project.CloudWatchLogsConfig (added)
AWS::CodeBuild::Project.LogsConfig (added)
AWS::CodeBuild::Project.S3LogsConfig (added)
AWS::CodeDeploy::DeploymentGroup.EC2TagSet (added)
AWS::CodeDeploy::DeploymentGroup.EC2TagSetListObject (added)
AWS::CodeDeploy::DeploymentGroup.OnPremisesTagSet (added)
AWS::CodeDeploy::DeploymentGroup.OnPremisesTagSetListObject (added)
AWS::EC2::SpotFleet.ClassicLoadBalancer (added)
AWS::EC2::SpotFleet.ClassicLoadBalancersConfig (added)
AWS::EC2::SpotFleet.FleetLaunchTemplateSpecification (added)
AWS::EC2::SpotFleet.LaunchTemplateConfig (added)
AWS::EC2::SpotFleet.LaunchTemplateOverrides (added)
AWS::EC2::SpotFleet.LoadBalancersConfig (added)
AWS::EC2::SpotFleet.TargetGroup (added)
AWS::EC2::SpotFleet.TargetGroupsConfig (added)
AWS::ECS::TaskDefinition.DockerVolumeConfiguration (added)
AWS::ECS::TaskDefinition.RepositoryCredentials (added)
AWS::ECS::TaskDefinition.Tmpfs (added)
AWS::Events::Rule.SqsParameters (added)
AWS::RDS::DBCluster.ScalingConfiguration (added)
AWS::ApiGateway::Deployment.StageDescription AccessLogSetting (added)
AWS::ApiGateway::Deployment.StageDescription CanarySetting (added)
AWS::ApiGateway::Method.Integration ConnectionId (added)
AWS::ApiGateway::Method.Integration ConnectionType (added)
AWS::ApiGateway::Method.Integration TimeoutInMillis (added)
AWS::ApiGateway::UsagePlan.ApiStage Throttle (added)
AWS::CodeBuild::Project.Artifacts ArtifactIdentifier (added)
AWS::CodeBuild::Project.Source SourceIdentifier (added)
AWS::CodeBuild::Project.VpcConfig SecurityGroupIds.Required (changed)
AWS::CodeBuild::Project.VpcConfig Subnets.Required (changed)
AWS::CodeBuild::Project.VpcConfig VpcId.Required (changed)
AWS::CodeDeploy::DeploymentGroup.EC2TagFilter Key.Documentation (changed)
AWS::CodeDeploy::DeploymentGroup.EC2TagFilter Type.Documentation (changed)
AWS::CodeDeploy::DeploymentGroup.EC2TagFilter Value.Documentation (changed)
AWS::CodeDeploy::DeploymentGroup.TagFilter Key.Documentation (changed)
AWS::CodeDeploy::DeploymentGroup.TagFilter Type.Documentation (changed)
AWS::CodeDeploy::DeploymentGroup.TagFilter Value.Documentation (changed)
AWS::EC2::SpotFleet.SpotFleetRequestConfigData InstanceInterruptionBehavior (added)
AWS::EC2::SpotFleet.SpotFleetRequestConfigData LaunchTemplateConfigs (added)
AWS::EC2::SpotFleet.SpotFleetRequestConfigData LoadBalancersConfig (added)
AWS::EC2::SpotFleet.SpotPlacement Tenancy (added)
AWS::ECS::Service.ServiceRegistry ContainerName (added)
AWS::ECS::Service.ServiceRegistry ContainerPort (added)
AWS::ECS::Service.ServiceRegistry Port.UpdateType (changed)
AWS::ECS::Service.ServiceRegistry RegistryArn.UpdateType (changed)
AWS::ECS::TaskDefinition.ContainerDefinition RepositoryCredentials (added)
AWS::ECS::TaskDefinition.LinuxParameters SharedMemorySize (added)
AWS::ECS::TaskDefinition.LinuxParameters Tmpfs (added)
AWS::ECS::TaskDefinition.Volume DockerVolumeConfiguration (added)
AWS::ElastiCache::ReplicationGroup.NodeGroupConfiguration NodeGroupId (added)
AWS::Events::Rule.Target SqsParameters (added)
AWS::RDS::OptionGroup.OptionConfiguration OptionSettings.DuplicatesAllowed (added)
AWS::RDS::OptionGroup.OptionConfiguration OptionSettings.ItemType (added)
AWS::RDS::OptionGroup.OptionConfiguration OptionSettings.Type (changed)
Readme
Define a role and add permissions to it. This will automatically create and attach an IAM policy to the role:
const role = new Role(this, 'MyRole', {
assumedBy: new ServicePrincipal('sns.amazonaws.com')
});
role.addPermission(new Permission('*', 'lambda:InvokeFunction'));
Define a policy and attach it to groups, users and roles. Note that it is possible to attach
the policy either by calling xxx.attachPolicy(policy) or policy.attachToXxx(xxx).
const user = new User(this, 'MyUser', { password: '1234' });
const group = new Group(this, 'MyGroup');
const policy = new Policy(this, 'MyPolicy');
policy.attachToUser(user);
group.attachPolicy(policy);
Managed policies can be attached using xxx.attachManagedPolicy(arn):
const group = new Group(this, 'MyGroup');
group.attachManagedPolicy('arn:aws:iam::aws:policy/AdministratorAccess');
FAQs
CDK routines for easily assigning correct and minimal IAM permissions
We found that @aws-cdk/aws-iam demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In an unprecedented surge, May 2024 saw the publication of over 5,000 CVEs, marking a historic milestone in cybersecurity with an average of 164 CVEs per day, nearly double the 2023 daily average.
Security News
The White House is addressing fragmented cybersecurity regulations as CISOs report spending up to 50% of their time on compliance, aiming to harmonize requirements and improve cybersecurity outcomes.
Security News
Research
The Socket Research Team has identified a malicious Python package that is typosquatting the popular crytic-compile utility, frequently used in popular toolkits and development environments for smart contracts and crypto applications.