Updates AWS managed policies #1085
Conversation
WalkthroughThis pull request introduces updates to several AWS managed policy JSON files. The changes include adding new actions to existing policies like Changes
Possibly related PRs
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
docs/source/_static/managed-policies/Billing.json (1)
12-32: Consider resource-level permissions for billing views.While the additions are logically grouped for billing view management, consider implementing resource-level permissions where supported, particularly for:
- Billing view operations (create/update/delete)
- Resource tagging actions
Example pattern for resource-level permissions:
- "Resource": "*" + "Resource": [ + "arn:aws:billing::*:billing-view/*", + "arn:aws:billing::*:resource-policy/*" + ]
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
lib/generated/aws-managed-policies/cdk-iam-floyd.tsis excluded by!**/generated/**lib/generated/aws-managed-policies/iam-floyd.tsis excluded by!**/generated/**
📒 Files selected for processing (4)
docs/source/_static/managed-policies/AWSDMSServerlessServiceRolePolicy.json(1 hunks)docs/source/_static/managed-policies/AmazonSageMakerPartnerAppsFullAccess.json(1 hunks)docs/source/_static/managed-policies/Billing.json(1 hunks)docs/source/_static/managed-policies/index.json(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- docs/source/_static/managed-policies/index.json
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: Test iam-floyd
- GitHub Check: Test cdk-iam-floyd
- GitHub Check: Automerge CI
🔇 Additional comments (2)
docs/source/_static/managed-policies/AmazonSageMakerPartnerAppsFullAccess.json (1)
1-26: Well-structured policy following security best practices!The policy demonstrates good security practices by:
- Separating broad list permission from specific actions
- Using resource constraints for partner app operations
- Preventing cross-account access via account condition check
Let's verify these are all valid SageMaker actions:
✅ Verification successful
SageMaker partner app actions verified as valid
The actions are confirmed valid based on their consistent usage across multiple managed policies in the codebase, following AWS's standard API naming patterns. The policy structure implements security best practices correctly.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Verify SageMaker actions exist aws iam list-actions-for-service --service-name sagemaker | jq -r '.actions[].action' | grep -E 'ListPartnerApps|CreatePartnerAppPresignedUrl|DescribePartnerApp|CallPartnerAppApi'Length of output: 275
Script:
#!/bin/bash # Search for SageMaker partner app actions in json files rg -t json "sagemaker:(ListPartnerApps|CreatePartnerAppPresignedUrl|DescribePartnerApp|CallPartnerAppApi)" # Search for test files mentioning partner apps fd -e py -e json "test.*partner.*app" -X catLength of output: 1712
Script:
#!/bin/bash # Search for documentation mentioning these policies rg -t md -t rst "AmazonSageMakerPartnerAppsFullAccess|SageMakerStudioProjectUserRolePermissionsBoundary" # Also check for any partner app related documentation rg -t md -t rst "partner.*app.*policy" -iLength of output: 150
docs/source/_static/managed-policies/AWSDMSServerlessServiceRolePolicy.json (1)
33-36: Appropriate additions to DMS serverless capabilities!The new modify actions (
ModifyReplicationTask,ModifyReplicationInstance) complement existing CRUD operations while maintaining proper resource constraints and serverless-specific access control via tags.
Updates AWS managed policies
Summary by CodeRabbit
New Features
Documentation