1 line
5.1 KiB
JSON
1 line
5.1 KiB
JSON
{"repo": "aws-ia/ecs-blueprints", "files": {"cdk/examples/data_pipeline/python/lib/data_pipeline_roles.py": {"99763badbb18f4f1ec5df3d14efbb2a578b2d989": {"t": 1785674632.6276116, "n": 4813, "h": "3791120483001d7f", "c": "import os\nimport aws_cdk.aws_iam as iam\nfrom lib.data_pipeline_stack_props import DataPipelineStackProps\n\ndef add_step_function_role_policies(stepfunctionExecutionRole:iam.Role, data_pipeline_stack_props: DataPipelineStackProps):\n stepfunctionExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= ['ecs:RunTask',\n \"ecs:TagResource\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:ecs:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':task-definition/*']\n ))\n stepfunctionExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"logs:CreateLogDelivery\",\n \"logs:GetLogDelivery\",\n \"logs:UpdateLogDelivery\",\n \"logs:DeleteLogDelivery\",\n \"logs:ListLogDeliveries\",\n \"logs:PutResourcePolicy\",\n \"logs:DescribeResourcePolicies\",\n \"logs:DescribeLogGroups\"],\n effect= iam.Effect.ALLOW,\n resources= [\"*\"]\n ))\n stepfunctionExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"xray:PutTraceSegments\",\n \"xray:PutTelemetryRecords\",\n \"xray:GetSamplingRules\",\n \"xray:GetSamplingTargets\"],\n effect= iam.Effect.ALLOW,\n resources= [\"*\"]\n ))\n\n return stepfunctionExecutionRole\n\ndef add_ecs_task_execution_role_policies(ecsTaskExecutionRole:iam.Role, data_pipeline_stack_props: DataPipelineStackProps):\n ecsTaskExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"ecr:GetAuthorizationToken\",\n \"ecr:BatchCheckLayerAvailability\",\n \"ecr:GetDownloadUrlForLayer\",\n \"ecr:BatchGetImage\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:ecr:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':*']\n ))\n ecsTaskExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"logs:CreateLogStream\",\n \"logs:PutLogEvents\"],\n effect= iam.Effect.ALLOW,\n resources= [\"*\"]\n ))\n ecsTaskExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"ec2:AuthorizeSecurityGroupIngress\",\n \"ec2:Describe*\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:ec2:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':*']\n ))\n ecsTaskExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"elasticloadbalancing:DeregisterInstancesFromLoadBalancer\",\n \"elasticloadbalancing:DeregisterTargets\",\n \"elasticloadbalancing:Describe*\",\n \"elasticloadbalancing:RegisterInstancesWithLoadBalancer\",\n \"elasticloadbalancing:RegisterTargets\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:elasticloadbalancing:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':*']\n ))\n\n return ecsTaskExecutionRole\n\ndef add_ecs_task_role_policies(ecsTaskRole: iam.Role, data_pipeline_stack_props: DataPipelineStackProps):\n ecsTaskRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"states:*\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:states:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':*']\n ))\n ecsTaskRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"ssm:DescribeParameters\",\n \"ssm:GetParameters\"],\n effect= iam.Effect.ALLOW,\n resources=['arn:aws:ssm:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':*']\n ))\n ecsTaskRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"kms:Decrypt\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:kms:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':*']\n ))\n ecsTaskRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"elasticfilesystem:*\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:elasticfilesystem:'+data_pipeline_stack_props.aws_region+':'+data_pipeline_stack_props.account_number+':*']\n ))\n ecsTaskRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"s3:*\",\n \"s3-object-lambda:*\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:s3:::*']\n ))\n\n return ecsTaskRole\n\ndef add_lambda_execution_role_policies(lambdaExecutionRole: iam.Role):\n lambdaExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"kms:Decrypt\"],\n effect= iam.Effect.ALLOW,\n resources= [\"*\"]\n ))\n lambdaExecutionRole.add_to_principal_policy(iam.PolicyStatement(\n actions= [\"s3:*\",\n \"s3-object-lambda:*\"],\n effect= iam.Effect.ALLOW,\n resources= ['arn:aws:s3:::*']\n ))\n\n return lambdaExecutionRole\n"}}}} |