fix: add missing actions to policy.json #1315
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
describe table has been needed since tailwarden#1111
list event source mappings has been needed since tailwarden#1040
list users has been needed since tailwarden#991
listbucket iam action is for the contents of a bucket
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey, thank you for opening your Pull Request ! 🙂 While a Tailwarden team member takes a look at your PR we would like to invite you to join our official Discord server, where you can interact directly with other contributors and Tailwarden team members. Link here: https://discord.tailwarden.com
roblambell
commented
Jan 8, 2024
| @@ -14,6 +19,7 @@ | |||
| "cloudwatch:ListTagsForResource", | |||
| "cloudwatch:ListDashboards", | |||
| "cloudwatch:ListMetricStreams", | |||
| "dynamodb:DescribeTable", | |||
roblambell
commented
Jan 8, 2024
| @@ -83,11 +90,12 @@ | |||
| "elasticfilesystem:DescribeFileSystems", | |||
| "elasticfilesystem:ListTagsForResource", | |||
| "iam:ListInstanceProfileTags", | |||
| "lambda:ListEventSourceMappings", | |||
roblambell
commented
Jan 8, 2024
| @@ -55,6 +61,7 @@ | |||
| "iam:ListRoles", | |||
| "iam:ListSAMLProviders", | |||
| "iam:ListSAMLProviderTags", | |||
| "iam:ListUsers", | |||
roblambell
commented
Jan 8, 2024
| @@ -6,6 +6,11 @@ | |||
| "Effect": "Allow", | |||
| "Action": [ | |||
| "apigateway:GET", | |||
| "codecommit:ListRepositories", | |||
| "codecommit:ListTagsForResource", | |||
| "codebuild:ListProjects", | |||
roblambell
commented
Jan 8, 2024
| @@ -6,6 +6,11 @@ | |||
| "Effect": "Allow", | |||
| "Action": [ | |||
| "apigateway:GET", | |||
| "codecommit:ListRepositories", | |||
roblambell
commented
Jan 8, 2024
| "codecommit:ListRepositories", | ||
| "codecommit:ListTagsForResource", | ||
| "codebuild:ListProjects", | ||
| "codedeploy:ListApplications", |
roblambell
commented
Jan 8, 2024
| "lambda:ListFunctions", | ||
| "lambda:ListTags", | ||
| "es:ListDomainNames", | ||
| "es:DescribeDomains", | ||
| "s3:ListBucket" |
There was a problem hiding this comment.
This permission is for listing objects/contents of a bucket - AFAIK we don't need it
Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000).
roblambell
commented
Jan 8, 2024
| "lambda:ListFunctions", | ||
| "lambda:ListTags", | ||
| "es:ListDomainNames", | ||
| "es:DescribeDomains", | ||
| "s3:ListBucket" | ||
| "s3:ListAllMyBuckets" |
There was a problem hiding this comment.
This permission is required for the S3.ListBuckets API method we're using
list all buckets owned by the authenticated sender of the request
roblambell
requested review from
mlabouardy,
ShubhamPalriwala,
AvineshTripathi,
greghub,
Traxmaxx,
Azanul and
jakepage91
as code owners
Azanul
approved these changes
Jan 9, 2024
AvineshTripathi
approved these changes
Jan 9, 2024
Azanul
pushed a commit
that referenced
this pull request
Jan 9, 2024
* feat: add missing dynamodb action to policy.json describe table has been needed since #1111 * feat: add missing lambda action to policy.json list event source mappings has been needed since #1040 * feat: add missing iam action to policy.json list users has been needed since #991 * fix: correct s3 permission for list buckets api call listbucket iam action is for the contents of a bucket * feat: add missing code suite actions to policy.json needed since #1216, #1229, and #1228
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
Actions missing from the recommended komiser policy
Solution
Add required actions to the policy (using https://aws.permissions.cloud/ as IAM <> API reference)
Changes Made
How to Test
Run komiser with the recommended policy and an AWS environment with affected resource.
Checklist