rolled back to old way of creating iam role

aws-observability · Sep 27, 2023 · af6c05e · af6c05e
1 parent 81862c3
commit af6c05e
Show file tree

Hide file tree

Showing 2 changed files with 85 additions and 83 deletions.
diff --git a/lib/multi-acc-new-eks-mixed-observability-pattern/create-iam-role.ts b/lib/multi-acc-new-eks-mixed-observability-pattern/create-iam-role.ts
@@ -19,8 +19,9 @@ interface Statement {
 export interface CreateIAMRoleNestedStackProps extends NestedStackProps {
     roleName: string,
     trustArn: string,
-    // actions: string[], resources: string[],
-    statement: Statement[],
+    actions: string[],
+    resources: string[],
+    // statement: Statement[],
 }
 
 // Stack that creates IAM role with trust relationship to other account
@@ -44,15 +45,16 @@ export class CreateIAMRoleNestedStack extends NestedStack {
             description: 'IAM Role created as part of CDK Observability Accelerator',
         });
 
-        props.statement.forEach((statement) => {
-            role.addToPolicy(iam.PolicyStatement.fromJson(statement))
-        });
+        // props.statement.forEach((statement) => {
+        //     role.addToPolicy(iam.PolicyStatement.fromJson(statement));
+        // });
+
         // role.addToPolicy(iam.PolicyStatement.fromJson(props.statement));
 
-        // role.addToPolicy(new iam.PolicyStatement({
-        //     actions: props.actions,
-        //     resources: props.resources,
-        // }));
+        role.addToPolicy(new iam.PolicyStatement({
+            actions: props.actions,
+            resources: props.resources,
+        }));
 
         new cdk.CfnOutput(this, `COAIAMRole-${props.roleName}`, { value: role ? role.roleArn : "none" });
     }

diff --git a/lib/multi-acc-new-eks-mixed-observability-pattern/pipeline.ts b/lib/multi-acc-new-eks-mixed-observability-pattern/pipeline.ts
@@ -100,91 +100,91 @@ export class PipelineMultiEnvMonitoring {
 
         // Props for cross-account trust role in PROD1 account to trust AMG from MON account, inorder to access PROD1's AMP
         ampAssumeRoleName = "AMPAccessForTrustedAMGRole";
-        const AMPAccessRoleStackProps: CreateIAMRoleNestedStackProps = {
-            roleName: ampAssumeRoleName!,
-            trustArn: amgWorkspaceIAMRoleARN!,
-            statement: getAMPAccessPolicyDocument()
-        };
         // const AMPAccessRoleStackProps: CreateIAMRoleNestedStackProps = {
         //     roleName: ampAssumeRoleName!,
         //     trustArn: amgWorkspaceIAMRoleARN!,
-        //     actions: [
-        //         "aps:ListWorkspaces",
-        //         "aps:DescribeWorkspace",
-        //         "aps:QueryMetrics",
-        //         "aps:GetLabels",
-        //         "aps:GetSeries",
-        //         "aps:GetMetricMetadata",
-        //         "xray:PutTraceSegments",
-        //         "xray:PutTelemetryRecords",
-        //         "xray:GetSamplingRules",
-        //         "xray:GetSamplingTargets",
-        //         "xray:GetSamplingStatisticSummaries",
-        //         "xray:BatchGetTraces",
-        //         "xray:GetServiceGraph",
-        //         "xray:GetTraceGraph",
-        //         "xray:GetTraceSummaries",
-        //         "xray:GetGroups",
-        //         "xray:GetGroup",
-        //         "xray:ListTagsForResource",
-        //         "xray:GetTimeSeriesServiceStatistics",
-        //         "xray:GetInsightSummaries",
-        //         "xray:GetInsight",
-        //         "xray:GetInsightEvents",
-        //         "xray:GetInsightImpactGraph",
-        //         "ssm:GetParameter"
-        //     ],
-        //     resources: ["*"]
+        //     statement: getAMPAccessPolicyDocument()
         // };
+        const AMPAccessRoleStackProps: CreateIAMRoleNestedStackProps = {
+            roleName: ampAssumeRoleName!,
+            trustArn: amgWorkspaceIAMRoleARN!,
+            actions: [
+                "aps:ListWorkspaces",
+                "aps:DescribeWorkspace",
+                "aps:QueryMetrics",
+                "aps:GetLabels",
+                "aps:GetSeries",
+                "aps:GetMetricMetadata",
+                "xray:PutTraceSegments",
+                "xray:PutTelemetryRecords",
+                "xray:GetSamplingRules",
+                "xray:GetSamplingTargets",
+                "xray:GetSamplingStatisticSummaries",
+                "xray:BatchGetTraces",
+                "xray:GetServiceGraph",
+                "xray:GetTraceGraph",
+                "xray:GetTraceSummaries",
+                "xray:GetGroups",
+                "xray:GetGroup",
+                "xray:ListTagsForResource",
+                "xray:GetTimeSeriesServiceStatistics",
+                "xray:GetInsightSummaries",
+                "xray:GetInsight",
+                "xray:GetInsightEvents",
+                "xray:GetInsightImpactGraph",
+                "ssm:GetParameter"
+            ],
+            resources: ["*"]
+        };
 
         // Props for cross-account trust role in PROD2 account to trust AMG from MON account, inorder to access PROD2's CloudWatch data
         cwAssumeRoleName = "CWAccessForTrustedAMGRole";
-        const CWAccessRoleStackProps: CreateIAMRoleNestedStackProps = {
-            roleName: cwAssumeRoleName,
-            trustArn: amgWorkspaceIAMRoleARN!,
-            statement: getCWAccessPolicyDocument()
-        };
         // const CWAccessRoleStackProps: CreateIAMRoleNestedStackProps = {
         //     roleName: cwAssumeRoleName,
         //     trustArn: amgWorkspaceIAMRoleARN!,
-        //     actions: [
-        //         "cloudwatch:DescribeAlarmsForMetric",
-        //         "cloudwatch:DescribeAlarmHistory",
-        //         "cloudwatch:DescribeAlarms",
-        //         "cloudwatch:ListMetrics",
-        //         "cloudwatch:GetMetricStatistics",
-        //         "cloudwatch:GetMetricData",
-        //         "logs:DescribeLogGroups",
-        //         "logs:GetLogGroupFields",
-        //         "logs:StartQuery",
-        //         "logs:StopQuery",
-        //         "logs:GetQueryResults",
-        //         "logs:GetLogEvents",
-        //         "ec2:DescribeTags",
-        //         "ec2:DescribeInstances",
-        //         "ec2:DescribeRegions",
-        //         "tag:GetResources",
-        //         "xray:PutTraceSegments",
-        //         "xray:PutTelemetryRecords",
-        //         "xray:GetSamplingRules",
-        //         "xray:GetSamplingTargets",
-        //         "xray:GetSamplingStatisticSummaries",
-        //         "xray:BatchGetTraces",
-        //         "xray:GetServiceGraph",
-        //         "xray:GetTraceGraph",
-        //         "xray:GetTraceSummaries",
-        //         "xray:GetGroups",
-        //         "xray:GetGroup",
-        //         "xray:ListTagsForResource",
-        //         "xray:GetTimeSeriesServiceStatistics",
-        //         "xray:GetInsightSummaries",
-        //         "xray:GetInsight",
-        //         "xray:GetInsightEvents",
-        //         "xray:GetInsightImpactGraph",
-        //         "ssm:GetParameter"
-        //     ],
-        //     resources: ["*"]
+        //     statement: getCWAccessPolicyDocument()
         // };
+        const CWAccessRoleStackProps: CreateIAMRoleNestedStackProps = {
+            roleName: cwAssumeRoleName,
+            trustArn: amgWorkspaceIAMRoleARN!,
+            actions: [
+                "cloudwatch:DescribeAlarmsForMetric",
+                "cloudwatch:DescribeAlarmHistory",
+                "cloudwatch:DescribeAlarms",
+                "cloudwatch:ListMetrics",
+                "cloudwatch:GetMetricStatistics",
+                "cloudwatch:GetMetricData",
+                "logs:DescribeLogGroups",
+                "logs:GetLogGroupFields",
+                "logs:StartQuery",
+                "logs:StopQuery",
+                "logs:GetQueryResults",
+                "logs:GetLogEvents",
+                "ec2:DescribeTags",
+                "ec2:DescribeInstances",
+                "ec2:DescribeRegions",
+                "tag:GetResources",
+                "xray:PutTraceSegments",
+                "xray:PutTelemetryRecords",
+                "xray:GetSamplingRules",
+                "xray:GetSamplingTargets",
+                "xray:GetSamplingStatisticSummaries",
+                "xray:BatchGetTraces",
+                "xray:GetServiceGraph",
+                "xray:GetTraceGraph",
+                "xray:GetTraceSummaries",
+                "xray:GetGroups",
+                "xray:GetGroup",
+                "xray:ListTagsForResource",
+                "xray:GetTimeSeriesServiceStatistics",
+                "xray:GetInsightSummaries",
+                "xray:GetInsight",
+                "xray:GetInsightEvents",
+                "xray:GetInsightImpactGraph",
+                "ssm:GetParameter"
+            ],
+            resources: ["*"]
+        };
 
         // creating constructs
         const ampConstruct = new AmpMonitoringConstruct();