aws-s3/notifications-resource: Scope down S3 bucket notifications lambda permission to only buckets it interacts with

[faridnsh]

Describe the feature

This lambda function(permission defined here) allows s3:PutBucketNotification with any bucket and we would need it to be only the buckets it actually sets the notification up with.

Use Case

Following security best practices of scoping down permissions.

Proposed Solution

I'm thinking we can move out the s3:PutBucketNotification permission definition from the notifications-resource-handler and move it to where we try to create it given a bucket.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

v2.96.2

Environment details (OS name and version, etc.)

any

[khushail]

Hi @alFReD-NSH , thanks for reaching out. There is another past request that is quite similar to what you have asked for.

A brief explanation of why "*" is used for resources is given here. A workaround is also mentioned in the follw-up comments in this shared issue.
Pls feel free to share your inputs as well.

[peterwoodworth]

Will prefer to reopen original thread, thanks for bringing this up and thanks @khushail for the investigating

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.