Security News
Cloudflare Adds Security.txt Setup Wizard
Cloudflare has launched a setup wizard allowing users to easily create and manage a security.txt file for vulnerability disclosure on their websites.
@aws-cdk/aws-iam
Advanced tools
CDK routines for easily assigning correct and minimal IAM permissions
@aws-cdk/aws-iam is an AWS Cloud Development Kit (CDK) library that allows you to define AWS Identity and Access Management (IAM) resources in your CDK applications. This package provides constructs for creating and managing IAM roles, users, policies, and groups, enabling you to manage permissions and access control in your AWS environment programmatically.
Create IAM Role
This code sample demonstrates how to create an IAM role that can be assumed by EC2 instances and has read-only access to Amazon S3.
const iam = require('@aws-cdk/aws-iam');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
new iam.Role(this, 'MyRole', {
assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess')
]
});
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
Create IAM User
This code sample demonstrates how to create an IAM user with administrator access.
const iam = require('@aws-cdk/aws-iam');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
new iam.User(this, 'MyUser', {
userName: 'my-user',
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess')
]
});
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
Attach Inline Policy to Role
This code sample demonstrates how to create an IAM role and attach an inline policy that allows listing objects in a specific S3 bucket.
const iam = require('@aws-cdk/aws-iam');
const cdk = require('@aws-cdk/core');
class MyStack extends cdk.Stack {
constructor(scope, id, props) {
super(scope, id, props);
const role = new iam.Role(this, 'MyRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')
});
role.addToPolicy(new iam.PolicyStatement({
actions: ['s3:ListBucket'],
resources: ['arn:aws:s3:::my-bucket']
}));
}
}
const app = new cdk.App();
new MyStack(app, 'MyStack');
The aws-sdk package is the official AWS SDK for JavaScript, which allows you to interact with AWS services, including IAM, using JavaScript. Unlike @aws-cdk/aws-iam, which is used for defining and deploying AWS infrastructure, aws-sdk is used for making API calls to AWS services.
The serverless framework is a toolkit for deploying and operating serverless architectures, including AWS Lambda functions and associated IAM roles and policies. It provides a higher-level abstraction compared to @aws-cdk/aws-iam and is focused on serverless applications.
Terraform is an open-source infrastructure as code software tool that provides a consistent CLI workflow to manage hundreds of cloud services, including AWS IAM. It is similar to @aws-cdk/aws-iam in that it allows you to define and manage AWS infrastructure, but it is not limited to AWS and supports multiple cloud providers.
Define a role and add permissions to it. This will automatically create and attach an IAM policy to the role:
Define a policy and attach it to groups, users and roles. Note that it is possible to attach
the policy either by calling xxx.attachInlinePolicy(policy)
or policy.attachToXxx(xxx)
.
attaching policies to user and group
Managed policies can be attached using xxx.attachManagedPolicy(arn)
:
If you need to create roles that will be assumed by 3rd parties, it is generally a good idea to require an ExternalId
to assume them. Configuring
an ExternalId
works like this:
When we say Principal, we mean an entity you grant permissions to. This
entity can be an AWS Service, a Role, or something more abstract such as "all
users in this account" or even "all users in this organization". An
Identity is an IAM representing a single IAM entity that can have
a policy attached, one of Role
, User
, or Group
.
When defining policy statements as part of an AssumeRole policy or as part of a
resource policy, statements would usually refer to a specific IAM principal
under Principal
.
IAM principals are modeled as classes that derive from the iam.PolicyPrincipal
abstract class. Principal objects include principal type (string) and value
(array of string), optional set of conditions and the action that this principal
requires when it is used in an assume role policy document.
To add a principal to a policy statement you can either use the abstract
statement.addPrincipal
, one of the concrete addXxxPrincipal
methods:
addAwsPrincipal
, addArnPrincipal
or new ArnPrincipal(arn)
for { "AWS": arn }
addAwsAccountPrincipal
or new AccountPrincipal(accountId)
for { "AWS": account-arn }
addServicePrincipal
or new ServicePrincipal(service)
for { "Service": service }
addAccountRootPrincipal
or new AccountRootPrincipal()
for { "AWS": { "Ref: "AWS::AccountId" } }
addCanonicalUserPrincipal
or new CanonicalUserPrincipal(id)
for { "CanonicalUser": id }
addFederatedPrincipal
or new FederatedPrincipal(federated, conditions, assumeAction)
for
{ "Federated": arn }
and a set of optional conditions and the assume role action to use.addAnyPrincipal
or new AnyPrincipal
for { "AWS": "*" }
If multiple principals are added to the policy statement, they will be merged together:
const statement = new PolicyStatement();
statement.addServicePrincipal('cloudwatch.amazonaws.com');
statement.addServicePrincipal('ec2.amazonaws.com');
statement.addAwsPrincipal('arn:aws:boom:boom');
Will result in:
{
"Principal": {
"Service": [ "cloudwatch.amazonaws.com", "ec2.amazonaws.com" ],
"AWS": "arn:aws:boom:boom"
}
}
The CompositePrincipal
class can also be used to define complex principals, for example:
const role = new iam.Role(this, 'MyRole', {
assumedBy: new iam.CompositePrincipal(
new iam.ServicePrincipal('ec2.amazonaws.com'),
new iam.AccountPrincipal('1818188181818187272')
)
});
0.32.0 (2019-05-24)
@aws-cdk/aws-route53-targets
package.IBucket.arnForObject
method no longer
concatenates path fragments on your behalf. Pass the /
-concatenated
key pattern instead.export
methods from all AWS resources have been removed. CloudFormation Exports are now automatically created when attributes are referenced across stacks within the same app. To export resources manually, you can explicitly define a CfnOutput
.kms.EncryptionKey
renamed to kms.Key
ec2.VpcNetwork
renamed to ec2.Vpc
ec2.VpcSubnet
renamed to ec2.Subnet
cloudtrail.CloudTrail
renamed to
cloudtrail.Trail`XxxAttribute
and XxxImportProps
interfaces which were no longer in used after their corresponding export
method was deleted and there was no use for them in imports.ecs.ClusterAttributes
now accepts IVpc
and ISecurityGroup
instead of attributes. You can use their
corresponding fromXxx
methods to import them as needed.servicediscovery.CnameInstance.instanceCname
renamed to cname
.glue.IDatabase.locationUrl
is now only in glue.Database
(not on the interface)ec2.TcpPortFromAttribute
and UdpPortFromAttribute
removed. Use TcpPort
and UdpPort
with new Token(x).toNumber
instead.ec2.VpcNetwork.importFromContext
renamed to ec2.Vpc.fromLookup
iam.IRole.roleId
has been removed from the interface, but Role.roleId
is still available for owned resources.loadBalancer
property in ServerDeploymentGroupProps has been changed.apigateway.ResourceBase.trackChild
is now internal.cloudfront.S3OriginConfig.originAccessIdentity
is now originAccessIdentityId
codedeploy.LambdaDeploymentGroup.alarms
is now cloudwatch.IAlarm[]
(previously cloudwatch.Alarm[]
)codepipeline.crossRegionScaffoldingStacks
renamed to crossRegionScaffolding
codepipeline.CrossRegionScaffoldingStack
renamed to codepipeline.CrossRegionScaffolding
and cannot be instantiated (abstract)ec2.VpcSubnet.addDefaultRouteToNAT
renamed to addDefaultNatRoute
and made publicec2.VpcSubnet.addDefaultRouteToIGW
renamed to addDefaultInternetRoute
, made public and first argument is the gateway ID (string) and not the CFN L1 classecs.Ec2EventRuleTarget.taskDefinition
is now ITaskDefinition
(previously TaskDefinition
)lambda.IEventSource.bind
now accepts IFunction
instead of FunctionBase
. Use IFunction.addEventSourceMapping
to add an event source mapping under the function.lambda.Layer.grantUsage
renamed to lambda.layer.addPermission
and returns voidstepfunctions.StateMachine.role
is now iam.IRole
(previously iam.Role
)onXxx()
CloudWatch Event methods now have the signature:
resource.onEvent('SomeId', {
target: new SomeTarget(...),
// options
});
onAlarm
was renamed to addAlarmAction
onOk
was renamed to addOkAction
onInsufficientData
was renamed to addInsufficientDataAction
onLifecycleTransition
was renamed to addLifecycleHook
onPreHook
was renamed to addPreHook
onPostHook
was renamed to addPostHook
onXxx
were renamed to addXxxTrigger
onImagePushed
was renamed to onCloudTrailImagePushed
onEvent
was renamed to addEventNotification
onObjectCreated
was renamed to addObjectCreatedNotification
onObjectRemoved
was renamed to addObjectRemovedNotification
onPutObject
was renamed to onCloudTrailPutObject
FAQs
CDK routines for easily assigning correct and minimal IAM permissions
The npm package @aws-cdk/aws-iam receives a total of 126,972 weekly downloads. As such, @aws-cdk/aws-iam popularity was classified as popular.
We found that @aws-cdk/aws-iam demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Cloudflare has launched a setup wizard allowing users to easily create and manage a security.txt file for vulnerability disclosure on their websites.
Security News
The Socket Research team breaks down a malicious npm package targeting the legitimate DOMPurify library. It uses obfuscated code to hide that it is exfiltrating browser and crypto wallet data.
Security News
ENISA’s 2024 report highlights the EU’s top cybersecurity threats, including rising DDoS attacks, ransomware, supply chain vulnerabilities, and weaponized AI.