fix: remove incorrect logic from complete example #671
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
aws:SourceVpce
conditionsaws_vpc_endpoint_service
data objectsDescription
Fix Complete VPC example code by removing several incorrect examples.
Motivation and Context
aws:SourceVpce
in a VPC endpoint IAM policy; all traffic that the VPC endpoint will receive will always have its own id here. You can read more about this key here under the section titled "Use IAM policies to control access to DynamoDB", in which the document states (emphasis mine):"You can create an IAM policy for your IAM users, groups, or roles to restrict access to DynamoDB tables from a specific VPC endpoint only. To do this, you can use the aws:sourceVpce condition key for the table resource in your IAM policy."
aws_vpc_endpoint
toaws_vpc_endpoint_service
. It's important to note this because previously the code useddata.aws_vpc_endpoint.dynamodb.id
which does exist and provides an id likevpce-12345
but was later replaced bydata.aws_vpc_endpoint_service.dynamodb.id
. You can see here thatid
is not a valid attribute and the output of this data type was a numerical id like1234
that seemed to have no bearing to vpc, vpc endpoint or any other active resource.The changes I've made continue to provide a policy for an example case, but the example now provides a somewhat more sensible value. In the new example code, the deny rule is set to reject any users who are outside of the current account.
Breaking Changes
This does not break any module code as it only affects an example
How Has This Been Tested?
examples/*
projectsI had to extensively debug why the example wasn't working and have cited all of my documentation.