fix: Conditionally create default NonSecureTransportAccessedViaMountTarget policy statement
#35
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
antonbabenko
requested changes
Nov 20, 2024
This reverts commit 6655a67.
antonbabenko
approved these changes
Nov 21, 2024
antonbabenko
changed the title
NonSecureTransportAccessedViaMountTarget statement only if policy_statements is not providedNonSecureTransportAccessedViaMountTarget policy statement
antonbabenko
approved these changes
Nov 21, 2024
|
Thank you, @magreenbaum ! |
antonbabenko
pushed a commit
that referenced
this pull request
Nov 21, 2024
## [1.6.5](v1.6.4...v1.6.5) (2024-11-21) ### Bug Fixes * Conditionally create default `NonSecureTransportAccessedViaMountTarget` policy statement ([#35](#35)) ([7c58eb1](7c58eb1))
|
This PR is included in version 1.6.5 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
The statement for
NonSecureTransportAccessedViaMountTargetoverrides any restricted permissions to IAM principals and actions that are passed intopolicy_statements. We can check ifpolicy_statementsare passed in and if not then create the mentioned statement.Other options would be to create a separate new variable like
use_default_deny_nonsecure_transport_policybut this may be redundant if we pass inpolicy_statementto customize access. We could also remove theNonSecureTransportAccessedViaMountTargetstatement altogether and require users to pass in any additional permissions viapolicy_statement. That would make it a breaking change though.Motivation and Context
Closes: #30
Breaking Changes
Potentially if users are passing in
policy_statementsto restrict IAM principals but are still making use of the allow all IAM principals (and related actions) thatNonSecureTransportAccessedViaMountTargetprovides instead. In that case, theNonSecureTransportAccessedViaMountTargetstatement will be removed.How Has This Been Tested?
examples/*to demonstrate and validate my change(s)examples/*projectspre-commit run -aon my pull request