77 AWS_ACCOUNT_NUMBER ,
88 AWS_REGION ,
99 LAMBDA_TYPE ,
10+ SFN_TYPE ,
1011 RUN_TASK_LAMBDA_NAME ,
1112 CHECK_TASK_LAMBDA_NAME
1213)
@@ -20,6 +21,7 @@ class IAM(object):
2021 account_id = AWS_ACCOUNT_NUMBER
2122 region = AWS_REGION
2223 lambda_type = LAMBDA_TYPE # lambda_type : '' for unicorn, 'pony' for pony, 'zebra' for zebra
24+ sfn_type = SFN_TYPE # sfn type : 'unicorn' for unicorn, 'pony' for pony, 'zebra' for zebra
2325 run_task_lambda_name = RUN_TASK_LAMBDA_NAME
2426 check_task_lambda_name = CHECK_TASK_LAMBDA_NAME
2527
@@ -48,6 +50,7 @@ def __init__(self, user_group_tag, bucket_names='', no_randomize=True):
4850 random_tag = str (int (random .random () * 10000 ))
4951 self .user_group_name = self .user_group_tag + '_' + random_tag
5052 self .tibanna_policy_prefix = self .prefix + self .user_group_name
53+ self .tibanna_sfn_name = self .prefix + self .sfn_type + '_' + self .user_group_name
5154
5255 # bucket names
5356 self .bucket_names = bucket_names
@@ -63,7 +66,8 @@ def iam_group_name(self):
6366 @property
6467 def policy_types (self ):
6568 return ['bucket' , 'termination' , 'list' , 'cloudwatch' , 'passrole' , 'lambdainvoke' ,
66- 'desc_stepfunction' , 'cloudwatch_metric' , 'cw_dashboard' , 'dynamodb' , 'ec2_desc' ]
69+ 'cloudwatch_metric' , 'cw_dashboard' , 'dynamodb' , 'ec2_desc' ,
70+ 'executions' ]
6771
6872 def policy_arn (self , policy_type ):
6973 return 'arn:aws:iam::' + self .account_id + ':policy/' + self .policy_name (policy_type )
@@ -75,11 +79,11 @@ def policy_suffix(self, policy_type):
7579 'cloudwatch' : 'cloudwatchlogs' ,
7680 'passrole' : 'iam_passrole_s3' ,
7781 'lambdainvoke' : 'lambdainvoke' ,
78- 'desc_stepfunction' : 'desc_sts' ,
7982 'cloudwatch_metric' : 'cw_metric' ,
8083 'cw_dashboard' : 'cw_dashboard' ,
8184 'dynamodb' : 'dynamodb' ,
82- 'ec2_desc' : 'ec2_desc' }
85+ 'ec2_desc' : 'ec2_desc' ,
86+ 'executions' : 'executions' }
8387 if policy_type not in suffices :
8488 raise Exception ("policy %s must be one of %s." % (policy_type , str (self .policy_types )))
8589 return suffices [policy_type ]
@@ -94,11 +98,11 @@ def policy_definition(self, policy_type):
9498 'cloudwatch' : self .policy_cloudwatchlogs ,
9599 'passrole' : self .policy_iam_passrole_s3 ,
96100 'lambdainvoke' : self .policy_lambdainvoke ,
97- 'desc_stepfunction' : self .policy_desc_stepfunction ,
98101 'cloudwatch_metric' : self .policy_cloudwatch_metric ,
99102 'cw_dashboard' : self .policy_cw_dashboard ,
100103 'dynamodb' : self .policy_dynamodb ,
101- 'ec2_desc' : self .policy_ec2_desc_policy }
104+ 'ec2_desc' : self .policy_ec2_desc_policy ,
105+ 'executions' : self .policy_executions }
102106 if policy_type not in definitions :
103107 raise Exception ("policy %s must be one of %s." % (policy_type , str (self .policy_types )))
104108 return definitions [policy_type ]
@@ -128,7 +132,7 @@ def role_service(self, role_type):
128132
129133 def policy_arn_list_for_role (self , role_type ):
130134 run_task_custom_policy_types = ['list' , 'cloudwatch' , 'passrole' , 'bucket' , 'dynamodb' ,
131- 'desc_stepfunction ' , 'cw_dashboard' ]
135+ 'executions ' , 'cw_dashboard' ]
132136 check_task_custom_policy_types = ['cloudwatch_metric' , 'cloudwatch' , 'bucket' , 'ec2_desc' ,
133137 'termination' , 'dynamodb' ]
134138 arnlist = {'ec2' : [self .policy_arn (_ ) for _ in ['bucket' , 'cloudwatch_metric' ]] +
@@ -268,18 +272,32 @@ def policy_lambdainvoke(self):
268272 return policy
269273
270274 @property
271- def policy_desc_stepfunction (self ):
272- execution_arn_prefix = 'arn:aws:states:' + self .region + ':' + self .account_id + ':execution:'
273- resource = execution_arn_prefix + self .tibanna_policy_prefix + ':*'
275+ def policy_executions (self ):
276+ execution_arn_prefix = 'arn:aws:states:' + self .region + ':' + self .account_id + ':stateMachine:'
277+ sfn_arn_prefix = 'arn:aws:states:' + self .region + ':' + self .account_id + ':execution:'
278+ resources = [execution_arn_prefix + self .tibanna_sfn_name ,
279+ sfn_arn_prefix + self .tibanna_sfn_name + ':*' ]
274280 policy = {
275281 "Version" : "2012-10-17" ,
276282 "Statement" : [
277283 {
278284 "Effect" : "Allow" ,
279285 "Action" : [
280- "states:DescribeExecution"
286+ "states:StartExecution" ,
287+ "states:StopExecution" ,
288+ "states:ListExecutions" ,
289+ "states:DescribeExecution" ,
290+ "states:GetExecutionHistory" ,
291+ "states:DescribeStateMachineForExecution" ,
292+ "states:DescribeStateMachine"
281293 ],
282- "Resource" : resource
294+ "Resource" : resources
295+ },
296+ {
297+ "Sid" : "VisualEditor1" ,
298+ "Effect" : "Allow" ,
299+ "Action" : "states:ListStateMachines" ,
300+ "Resource" : "*"
283301 }
284302 ]
285303 }
@@ -421,16 +439,6 @@ def create_user_group(self, verbose=False):
421439 # deleting a group would require users to be detached from the group.
422440 self .detach_policies_from_group ()
423441 group = self .iam .Group (self .iam_group_name )
424- response = group .attach_policy (
425- PolicyArn = 'arn:aws:iam::aws:policy/AWSStepFunctionsFullAccess'
426- )
427- if verbose :
428- logger .debug ("response from IAM attach_policy :" + str (response ))
429- response = group .attach_policy (
430- PolicyArn = 'arn:aws:iam::aws:policy/AWSStepFunctionsConsoleFullAccess'
431- )
432- if verbose :
433- logger .debug ("response from IAM attach_policy :" + str (response ))
434442 response = group .attach_policy (
435443 PolicyArn = 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
436444 )
@@ -441,7 +449,8 @@ def create_user_group(self, verbose=False):
441449 )
442450 if verbose :
443451 logger .debug ("response from IAM attach_policy :" + str (response ))
444- custom_policy_types = ['bucket' , 'ec2_desc' , 'cloudwatch_metric' , 'dynamodb' , 'termination' ]
452+ custom_policy_types = ['bucket' , 'ec2_desc' , 'cloudwatch_metric' , 'dynamodb' ,
453+ 'termination' , 'executions' ]
445454 for pn in [self .policy_name (pt ) for pt in custom_policy_types ]:
446455 response = group .attach_policy (
447456 PolicyArn = 'arn:aws:iam::' + self .account_id + ':policy/' + pn
0 commit comments