@sgorg/datawarehouse-common - npm Package Compare versions

Comparing version 1.17.2 to 1.17.3

dist/constructs/lambda/index.d.ts

@@ -14,2 +14,3 @@ import { Construct } from 'constructs';
     role: IamRole;
+    execRolePolicy: IamPolicy;
     execRolePolicyAttachment: IamRolePolicyAttachment;
@@ -24,2 +25,3 @@ readEnvVarsPolicyAttachment: IamRolePolicyAttachment;
     createRole(): IamRole;
+    createExecutionRolePolicy(): IamPolicy;
     attachExecPolicy(): IamRolePolicyAttachment;
@@ -26,0 +28,0 @@ defineS3Object(): S3BucketObject;

dist/constructs/lambda/index.js

@@ -46,3 +46,2 @@ "use strict";
 const data_aws_caller_identity_1 = require("@cdktf/provider-aws/lib/data-aws-caller-identity");
-const lambda_1 = require("../../config/lambda");
 const secrets_1 = __importDefault(require("./secrets"));
@@ -57,2 +56,3 @@ exports.LambdaSecrets = secrets_1.default;
         this.readEnvVarsPolicyAttachment = this.attachReadEnvVarsPolicy();
+        this.execRolePolicy = this.createExecutionRolePolicy();
         this.execRolePolicyAttachment = this.attachExecPolicy();
@@ -90,4 +90,40 @@ this.s3bucketObject = this.defineS3Object();
     }
+    createExecutionRolePolicy() {
+        const { scope, config } = this;
+        const { getResourceIds, functionName, tags, provider, } = config;
+        const policy = {
+            Version: '2012-10-17',
+            Statement: [
+                {
+                    Effect: 'Allow',
+                    Action: [
+                        'logs:CreateLogGroup',
+                        'logs:CreateLogStream',
+                        'logs:PutLogEvents',
+                        'ec2:CreateNetworkInterface',
+                        'ec2:DescribeNetworkInterfaces',
+                        'ec2:DeleteNetworkInterface',
+                        'ec2:AssignPrivateIpAddresses',
+                        'ec2:UnassignPrivateIpAddresses',
+                        'ec2:DescribeSecurityGroups',
+                        'ec2:DescribeSubnets',
+                        'ec2:DescribeVpcs',
+                    ],
+                    Resource: '*',
+                },
+            ],
+        };
+        const { id, name } = getResourceIds({
+            id: `exec-role-${functionName}`,
+            type: iam_policy_1.IamPolicy.tfResourceType,
+        });
+        return new iam_policy_1.IamPolicy(scope, id, {
+            policy: JSON.stringify(policy),
+            name,
+            tags,
+            provider,
+        });
+    }
     attachExecPolicy() {
-        const { functionName, provider, getResourceIds, } = this.config;
+        const { functionName, provider, getResourceIds } = this.config;
         const { id } = getResourceIds({
@@ -98,5 +134,5 @@ id: `exec-${functionName}`,
         return new iam_role_policy_attachment_1.IamRolePolicyAttachment(this.scope, id, {
-            policyArn: lambda_1.LAMBDA_VPC_ACCESS_EXECUTION_POLICY_ARN,
+            policyArn: this.execRolePolicy.arn,
             role: `${this.role.name}`,
-            dependsOn: [this.role],
+            dependsOn: [this.role, this.execRolePolicy],
             provider,
@@ -107,3 +143,6 @@ });
         const { codeBucketName, functionName, provider, getResourceIds, } = this.config;
-        const assetResource = getResourceIds({ id: functionName, type: 'lambda-asset' });
+        const assetResource = getResourceIds({
+            id: functionName,
+            type: 'lambda-asset',
+        });
         const asset = new cdktf_1.TerraformAsset(this.scope, assetResource.id, {
@@ -210,3 +249,6 @@ path: path.resolve(__dirname, '../../lambdaSource'),
         const { permissions = [], getResourceIds, functionName } = this.config;
-        const { id } = getResourceIds({ id: `lambda-${functionName}`, type: data_aws_caller_identity_1.DataAwsCallerIdentity.tfResourceType });
+        const { id } = getResourceIds({
+            id: `lambda-${functionName}`,
+            type: data_aws_caller_identity_1.DataAwsCallerIdentity.tfResourceType,
+        });
         const { accountId } = new data_aws_caller_identity_1.DataAwsCallerIdentity(this.scope, id);
@@ -213,0 +255,0 @@ return permissions

package.json

 {
   "name": "@sgorg/datawarehouse-common",
-  "version": "1.17.2",
+  "version": "1.17.3",
   "description": "Project to share constants and configuration across iac projects",
@@ -5,0 +5,0 @@ "main": "./dist/main.js",

No alert changes

Improved metrics

Total package byte prevSize

70420

increased by3.33%

Lines of code

1107

increased by4.14%

No dependency changes