Serverlessデプロイ用のIAMユーザーを作成 #25
Merged
+147
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
keitakn
commented
Apr 25, 2021
Comment on lines
+16
to
+18
| "cognito-identity:*", | ||
| "cognito-sync:*", | ||
| "cognito-idp:*" |
There was a problem hiding this comment.
GitHubログインの時にCognitoUserPoolのカスタムLambdaが必要になるから追加🐱
keitakn
commented
Apr 25, 2021
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": "apigateway:*", |
There was a problem hiding this comment.
GitHubログイン実行時にUserPoolのトークン発行APIを使う可能性があるので追加🐱
（そもそもServerlessで実装するかも分からないので、いらないかも）
keitakn
commented
Apr 25, 2021
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": "cloudfront:*", |
There was a problem hiding this comment.
apigateway* を付けるとセットでこれも付けないと駄目だったので追加🐱
何故なのか理由はよく分からない・・・
多分APIGatewayの裏側ではCloudFrontが使われているからそのせい？？
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
issueURL
#14
Doneの定義
変更点概要
providers/aws/environments/prod/14-iam/を追加しserverless deployで利用する為のIAMユーザーを作成。IAMポリシーは こちらの記事 にある通り、admin権限を持ったIAMユーザーで実際に
serverless deployを実行した履歴を元に作成。ただし、いくつかの権限に関しては手動で追加している。（対象箇所のインラインコメントを参照）
動作確認は以下の2つで行った。
レビュアーに重点的にチェックして欲しい点
多分これでも、無駄な権限はあるけど、
AdministratorAccessをアタッチするよりはマシだと思う🐱ポリシーの内容見て問題ないか確認してもらえると:pray:
今後必要な権限が増えたら
serverless-deploy-policy.jsonに追加していく感じで良いと思う！補足情報
複数のリポジトリで利用するので以下の名前で
organizations secretとして追加済。