@friggframework/devtools 2.0.0--canary.398.a314355.0 → 2.0.0--canary.397.4957a89.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/frigg-cli/build-command/index.js +2 -4
  2. package/frigg-cli/deploy-command/index.js +2 -5
  3. package/frigg-cli/index.js +1 -11
  4. package/infrastructure/create-frigg-infrastructure.js +2 -10
  5. package/infrastructure/serverless-template.js +27 -599
  6. package/package.json +5 -9
  7. package/test/index.js +2 -4
  8. package/test/mock-integration.js +4 -14
  9. package/frigg-cli/generate-iam-command.js +0 -115
  10. package/infrastructure/AWS-DISCOVERY-TROUBLESHOOTING.md +0 -245
  11. package/infrastructure/AWS-IAM-CREDENTIAL-NEEDS.md +0 -561
  12. package/infrastructure/DEPLOYMENT-INSTRUCTIONS.md +0 -268
  13. package/infrastructure/GENERATE-IAM-DOCS.md +0 -253
  14. package/infrastructure/IAM-POLICY-TEMPLATES.md +0 -172
  15. package/infrastructure/README-TESTING.md +0 -332
  16. package/infrastructure/WEBSOCKET-CONFIGURATION.md +0 -105
  17. package/infrastructure/__tests__/fixtures/mock-aws-resources.js +0 -391
  18. package/infrastructure/__tests__/helpers/test-utils.js +0 -277
  19. package/infrastructure/aws-discovery.js +0 -460
  20. package/infrastructure/aws-discovery.test.js +0 -373
  21. package/infrastructure/build-time-discovery.js +0 -206
  22. package/infrastructure/build-time-discovery.test.js +0 -375
  23. package/infrastructure/frigg-deployment-iam-stack.yaml +0 -365
  24. package/infrastructure/iam-generator.js +0 -696
  25. package/infrastructure/iam-generator.test.js +0 -169
  26. package/infrastructure/iam-policy-basic.json +0 -196
  27. package/infrastructure/iam-policy-full.json +0 -266
  28. package/infrastructure/integration.test.js +0 -383
  29. package/infrastructure/run-discovery.js +0 -110
  30. package/infrastructure/serverless-template.test.js +0 -498
  31. package/test/auther-definition-tester.js +0 -125
package/infrastructure/iam-generator.test.js DELETED
@@ -1,169 +0,0 @@
1
- const { generateIAMCloudFormation, getFeatureSummary } = require('./iam-generator');
2
-
3
- describe('IAM Generator', () => {
4
- describe('getFeatureSummary', () => {
5
- it('should detect all features when enabled', () => {
6
- const appDefinition = {
7
- name: 'test-app',
8
- integrations: ['Integration1', 'Integration2'],
9
- vpc: { enable: true },
10
- encryption: { useDefaultKMSForFieldLevelEncryption: true },
11
- ssm: { enable: true },
12
- websockets: { enable: true }
13
- };
14
-
15
- const summary = getFeatureSummary(appDefinition);
16
-
17
- expect(summary.appName).toBe('test-app');
18
- expect(summary.integrationCount).toBe(2);
19
- expect(summary.features.core).toBe(true);
20
- expect(summary.features.vpc).toBe(true);
21
- expect(summary.features.kms).toBe(true);
22
- expect(summary.features.ssm).toBe(true);
23
- expect(summary.features.websockets).toBe(true);
24
- });
25
-
26
- it('should detect minimal features when disabled', () => {
27
- const appDefinition = {
28
- integrations: []
29
- };
30
-
31
- const summary = getFeatureSummary(appDefinition);
32
-
33
- expect(summary.appName).toBe('Unnamed Frigg App');
34
- expect(summary.integrationCount).toBe(0);
35
- expect(summary.features.core).toBe(true);
36
- expect(summary.features.vpc).toBe(false);
37
- expect(summary.features.kms).toBe(false);
38
- expect(summary.features.ssm).toBe(false);
39
- expect(summary.features.websockets).toBe(false);
40
- });
41
- });
42
-
43
- describe('generateIAMCloudFormation', () => {
44
- it('should generate valid CloudFormation YAML', () => {
45
- const appDefinition = {
46
- name: 'test-app',
47
- integrations: [],
48
- vpc: { enable: false },
49
- encryption: { useDefaultKMSForFieldLevelEncryption: false },
50
- ssm: { enable: false },
51
- websockets: { enable: false }
52
- };
53
-
54
- const yaml = generateIAMCloudFormation(appDefinition);
55
-
56
- expect(yaml).toContain('AWSTemplateFormatVersion');
57
- expect(yaml).toContain('FriggDeploymentUser');
58
- expect(yaml).toContain('FriggCoreDeploymentPolicy');
59
- expect(yaml).toContain('FriggDiscoveryPolicy');
60
- });
61
-
62
- it('should include VPC policy when VPC is enabled', () => {
63
- const appDefinition = {
64
- name: 'test-app',
65
- integrations: [],
66
- vpc: { enable: true }
67
- };
68
-
69
- const yaml = generateIAMCloudFormation(appDefinition);
70
-
71
- expect(yaml).toContain('FriggVPCPolicy');
72
- expect(yaml).toContain('CreateVPCPermissions');
73
- expect(yaml).toContain('EnableVPCSupport');
74
- });
75
-
76
- it('should include KMS policy when encryption is enabled', () => {
77
- const appDefinition = {
78
- name: 'test-app',
79
- integrations: [],
80
- encryption: { useDefaultKMSForFieldLevelEncryption: true }
81
- };
82
-
83
- const yaml = generateIAMCloudFormation(appDefinition);
84
-
85
- expect(yaml).toContain('FriggKMSPolicy');
86
- expect(yaml).toContain('CreateKMSPermissions');
87
- expect(yaml).toContain('EnableKMSSupport');
88
- });
89
-
90
- it('should include SSM policy when SSM is enabled', () => {
91
- const appDefinition = {
92
- name: 'test-app',
93
- integrations: [],
94
- ssm: { enable: true }
95
- };
96
-
97
- const yaml = generateIAMCloudFormation(appDefinition);
98
-
99
- expect(yaml).toContain('FriggSSMPolicy');
100
- expect(yaml).toContain('CreateSSMPermissions');
101
- expect(yaml).toContain('EnableSSMSupport');
102
- });
103
-
104
- it('should set correct default parameter values based on features', () => {
105
- const appDefinition = {
106
- name: 'test-app',
107
- integrations: [],
108
- vpc: { enable: true },
109
- encryption: { useDefaultKMSForFieldLevelEncryption: false },
110
- ssm: { enable: true }
111
- };
112
-
113
- const yaml = generateIAMCloudFormation(appDefinition);
114
-
115
- // Check parameter defaults match the enabled features
116
- expect(yaml).toContain('Default: true'); // VPC enabled
117
- expect(yaml).toContain('Default: false'); // KMS disabled
118
- // SSM should be true
119
- });
120
-
121
- it('should include all core permissions', () => {
122
- const appDefinition = {
123
- name: 'test-app',
124
- integrations: []
125
- };
126
-
127
- const yaml = generateIAMCloudFormation(appDefinition);
128
-
129
- // Check for core permissions
130
- expect(yaml).toContain('cloudformation:CreateStack');
131
- expect(yaml).toContain('cloudformation:ListStackResources');
132
- expect(yaml).toContain('lambda:CreateFunction');
133
- expect(yaml).toContain('iam:CreateRole');
134
- expect(yaml).toContain('s3:CreateBucket');
135
- expect(yaml).toContain('sqs:CreateQueue');
136
- expect(yaml).toContain('sns:CreateTopic');
137
- expect(yaml).toContain('logs:CreateLogGroup');
138
- expect(yaml).toContain('apigateway:POST');
139
- expect(yaml).toContain('lambda:ListVersionsByFunction');
140
- expect(yaml).toContain('iam:ListPolicyVersions');
141
- });
142
-
143
- it('should include internal-error-queue pattern in SQS resources', () => {
144
- const appDefinition = {
145
- name: 'test-app',
146
- integrations: []
147
- };
148
-
149
- const yaml = generateIAMCloudFormation(appDefinition);
150
-
151
- expect(yaml).toContain('internal-error-queue-*');
152
- });
153
-
154
- it('should generate outputs section', () => {
155
- const appDefinition = {
156
- name: 'test-app',
157
- integrations: []
158
- };
159
-
160
- const yaml = generateIAMCloudFormation(appDefinition);
161
-
162
- expect(yaml).toContain('Outputs:');
163
- expect(yaml).toContain('DeploymentUserArn:');
164
- expect(yaml).toContain('AccessKeyId:');
165
- expect(yaml).toContain('SecretAccessKeyCommand:');
166
- expect(yaml).toContain('CredentialsSecretArn:');
167
- });
168
- });
169
- });
package/infrastructure/iam-policy-basic.json DELETED
@@ -1,196 +0,0 @@
1
- {
2
- "Version": "2012-10-17",
3
- "Statement": [
4
- {
5
- "Sid": "AWSDiscoveryPermissions",
6
- "Effect": "Allow",
7
- "Action": [
8
- "sts:GetCallerIdentity",
9
- "ec2:DescribeVpcs",
10
- "ec2:DescribeSubnets",
11
- "ec2:DescribeSecurityGroups",
12
- "ec2:DescribeRouteTables",
13
- "kms:ListKeys",
14
- "kms:DescribeKey"
15
- ],
16
- "Resource": "*"
17
- },
18
- {
19
- "Sid": "CloudFormationFriggStacks",
20
- "Effect": "Allow",
21
- "Action": [
22
- "cloudformation:CreateStack",
23
- "cloudformation:UpdateStack",
24
- "cloudformation:DeleteStack",
25
- "cloudformation:DescribeStacks",
26
- "cloudformation:DescribeStackEvents",
27
- "cloudformation:DescribeStackResources",
28
- "cloudformation:DescribeStackResource",
29
- "cloudformation:ListStackResources",
30
- "cloudformation:GetTemplate",
31
- "cloudformation:ValidateTemplate",
32
- "cloudformation:DescribeChangeSet",
33
- "cloudformation:CreateChangeSet",
34
- "cloudformation:DeleteChangeSet",
35
- "cloudformation:ExecuteChangeSet"
36
- ],
37
- "Resource": [
38
- "arn:aws:cloudformation:*:*:stack/*frigg*/*"
39
- ]
40
- },
41
- {
42
- "Sid": "S3DeploymentBucket",
43
- "Effect": "Allow",
44
- "Action": [
45
- "s3:CreateBucket",
46
- "s3:PutObject",
47
- "s3:GetObject",
48
- "s3:DeleteObject",
49
- "s3:PutBucketPolicy",
50
- "s3:PutBucketVersioning",
51
- "s3:PutBucketPublicAccessBlock",
52
- "s3:GetBucketLocation",
53
- "s3:ListBucket"
54
- ],
55
- "Resource": [
56
- "arn:aws:s3:::*serverless*",
57
- "arn:aws:s3:::*serverless*/*"
58
- ]
59
- },
60
- {
61
- "Sid": "LambdaFriggFunctions",
62
- "Effect": "Allow",
63
- "Action": [
64
- "lambda:CreateFunction",
65
- "lambda:UpdateFunctionCode",
66
- "lambda:UpdateFunctionConfiguration",
67
- "lambda:DeleteFunction",
68
- "lambda:GetFunction",
69
- "lambda:ListFunctions",
70
- "lambda:PublishVersion",
71
- "lambda:CreateAlias",
72
- "lambda:UpdateAlias",
73
- "lambda:DeleteAlias",
74
- "lambda:GetAlias",
75
- "lambda:AddPermission",
76
- "lambda:RemovePermission",
77
- "lambda:GetPolicy",
78
- "lambda:PutProvisionedConcurrencyConfig",
79
- "lambda:DeleteProvisionedConcurrencyConfig",
80
- "lambda:PutConcurrency",
81
- "lambda:DeleteConcurrency",
82
- "lambda:TagResource",
83
- "lambda:UntagResource",
84
- "lambda:ListVersionsByFunction"
85
- ],
86
- "Resource": [
87
- "arn:aws:lambda:*:*:function:*frigg*"
88
- ]
89
- },
90
- {
91
- "Sid": "IAMRolesForFriggLambda",
92
- "Effect": "Allow",
93
- "Action": [
94
- "iam:CreateRole",
95
- "iam:DeleteRole",
96
- "iam:GetRole",
97
- "iam:PassRole",
98
- "iam:PutRolePolicy",
99
- "iam:DeleteRolePolicy",
100
- "iam:GetRolePolicy",
101
- "iam:AttachRolePolicy",
102
- "iam:DetachRolePolicy",
103
- "iam:TagRole",
104
- "iam:UntagRole"
105
- ],
106
- "Resource": [
107
- "arn:aws:iam::*:role/*frigg*",
108
- "arn:aws:iam::*:role/*frigg*LambdaRole*"
109
- ]
110
- },
111
- {
112
- "Sid": "IAMPolicyVersionPermissions",
113
- "Effect": "Allow",
114
- "Action": [
115
- "iam:ListPolicyVersions"
116
- ],
117
- "Resource": [
118
- "arn:aws:iam::*:policy/*"
119
- ]
120
- },
121
- {
122
- "Sid": "FriggMessagingServices",
123
- "Effect": "Allow",
124
- "Action": [
125
- "sqs:CreateQueue",
126
- "sqs:DeleteQueue",
127
- "sqs:GetQueueAttributes",
128
- "sqs:SetQueueAttributes",
129
- "sqs:GetQueueUrl",
130
- "sqs:TagQueue",
131
- "sqs:UntagQueue"
132
- ],
133
- "Resource": [
134
- "arn:aws:sqs:*:*:*frigg*",
135
- "arn:aws:sqs:*:*:internal-error-queue-*"
136
- ]
137
- },
138
- {
139
- "Sid": "FriggSNSTopics",
140
- "Effect": "Allow",
141
- "Action": [
142
- "sns:CreateTopic",
143
- "sns:DeleteTopic",
144
- "sns:GetTopicAttributes",
145
- "sns:SetTopicAttributes",
146
- "sns:Subscribe",
147
- "sns:Unsubscribe",
148
- "sns:ListSubscriptionsByTopic",
149
- "sns:TagResource",
150
- "sns:UntagResource"
151
- ],
152
- "Resource": [
153
- "arn:aws:sns:*:*:*frigg*"
154
- ]
155
- },
156
- {
157
- "Sid": "FriggMonitoringAndLogs",
158
- "Effect": "Allow",
159
- "Action": [
160
- "cloudwatch:PutMetricAlarm",
161
- "cloudwatch:DeleteAlarms",
162
- "cloudwatch:DescribeAlarms",
163
- "logs:CreateLogGroup",
164
- "logs:CreateLogStream",
165
- "logs:DeleteLogGroup",
166
- "logs:DescribeLogGroups",
167
- "logs:DescribeLogStreams",
168
- "logs:FilterLogEvents",
169
- "logs:PutLogEvents",
170
- "logs:PutRetentionPolicy"
171
- ],
172
- "Resource": [
173
- "arn:aws:logs:*:*:log-group:/aws/lambda/*frigg*",
174
- "arn:aws:logs:*:*:log-group:/aws/lambda/*frigg*:*",
175
- "arn:aws:cloudwatch:*:*:alarm:*frigg*"
176
- ]
177
- },
178
- {
179
- "Sid": "FriggAPIGateway",
180
- "Effect": "Allow",
181
- "Action": [
182
- "apigateway:POST",
183
- "apigateway:PUT",
184
- "apigateway:DELETE",
185
- "apigateway:GET",
186
- "apigateway:PATCH"
187
- ],
188
- "Resource": [
189
- "arn:aws:apigateway:*::/restapis",
190
- "arn:aws:apigateway:*::/restapis/*",
191
- "arn:aws:apigateway:*::/domainnames",
192
- "arn:aws:apigateway:*::/domainnames/*"
193
- ]
194
- }
195
- ]
196
- }
package/infrastructure/iam-policy-full.json DELETED
@@ -1,266 +0,0 @@
1
- {
2
- "Version": "2012-10-17",
3
- "Statement": [
4
- {
5
- "Sid": "AWSDiscoveryPermissions",
6
- "Effect": "Allow",
7
- "Action": [
8
- "sts:GetCallerIdentity",
9
- "ec2:DescribeVpcs",
10
- "ec2:DescribeSubnets",
11
- "ec2:DescribeSecurityGroups",
12
- "ec2:DescribeRouteTables",
13
- "kms:ListKeys",
14
- "kms:DescribeKey"
15
- ],
16
- "Resource": "*"
17
- },
18
- {
19
- "Sid": "CloudFormationFriggStacks",
20
- "Effect": "Allow",
21
- "Action": [
22
- "cloudformation:CreateStack",
23
- "cloudformation:UpdateStack",
24
- "cloudformation:DeleteStack",
25
- "cloudformation:DescribeStacks",
26
- "cloudformation:DescribeStackEvents",
27
- "cloudformation:DescribeStackResources",
28
- "cloudformation:DescribeStackResource",
29
- "cloudformation:ListStackResources",
30
- "cloudformation:GetTemplate",
31
- "cloudformation:ValidateTemplate",
32
- "cloudformation:DescribeChangeSet",
33
- "cloudformation:CreateChangeSet",
34
- "cloudformation:DeleteChangeSet",
35
- "cloudformation:ExecuteChangeSet"
36
- ],
37
- "Resource": [
38
- "arn:aws:cloudformation:*:*:stack/*frigg*/*"
39
- ]
40
- },
41
- {
42
- "Sid": "S3DeploymentBucket",
43
- "Effect": "Allow",
44
- "Action": [
45
- "s3:CreateBucket",
46
- "s3:PutObject",
47
- "s3:GetObject",
48
- "s3:DeleteObject",
49
- "s3:PutBucketPolicy",
50
- "s3:PutBucketVersioning",
51
- "s3:PutBucketPublicAccessBlock",
52
- "s3:GetBucketLocation",
53
- "s3:ListBucket"
54
- ],
55
- "Resource": [
56
- "arn:aws:s3:::*serverless*",
57
- "arn:aws:s3:::*serverless*/*"
58
- ]
59
- },
60
- {
61
- "Sid": "LambdaFriggFunctions",
62
- "Effect": "Allow",
63
- "Action": [
64
- "lambda:CreateFunction",
65
- "lambda:UpdateFunctionCode",
66
- "lambda:UpdateFunctionConfiguration",
67
- "lambda:DeleteFunction",
68
- "lambda:GetFunction",
69
- "lambda:ListFunctions",
70
- "lambda:PublishVersion",
71
- "lambda:CreateAlias",
72
- "lambda:UpdateAlias",
73
- "lambda:DeleteAlias",
74
- "lambda:GetAlias",
75
- "lambda:AddPermission",
76
- "lambda:RemovePermission",
77
- "lambda:GetPolicy",
78
- "lambda:PutProvisionedConcurrencyConfig",
79
- "lambda:DeleteProvisionedConcurrencyConfig",
80
- "lambda:PutConcurrency",
81
- "lambda:DeleteConcurrency",
82
- "lambda:TagResource",
83
- "lambda:UntagResource",
84
- "lambda:ListVersionsByFunction"
85
- ],
86
- "Resource": [
87
- "arn:aws:lambda:*:*:function:*frigg*"
88
- ]
89
- },
90
- {
91
- "Sid": "IAMRolesForFriggLambda",
92
- "Effect": "Allow",
93
- "Action": [
94
- "iam:CreateRole",
95
- "iam:DeleteRole",
96
- "iam:GetRole",
97
- "iam:PassRole",
98
- "iam:PutRolePolicy",
99
- "iam:DeleteRolePolicy",
100
- "iam:GetRolePolicy",
101
- "iam:AttachRolePolicy",
102
- "iam:DetachRolePolicy",
103
- "iam:TagRole",
104
- "iam:UntagRole"
105
- ],
106
- "Resource": [
107
- "arn:aws:iam::*:role/*frigg*",
108
- "arn:aws:iam::*:role/*frigg*LambdaRole*"
109
- ]
110
- },
111
- {
112
- "Sid": "IAMPolicyVersionPermissions",
113
- "Effect": "Allow",
114
- "Action": [
115
- "iam:ListPolicyVersions"
116
- ],
117
- "Resource": [
118
- "arn:aws:iam::*:policy/*"
119
- ]
120
- },
121
- {
122
- "Sid": "FriggMessagingServices",
123
- "Effect": "Allow",
124
- "Action": [
125
- "sqs:CreateQueue",
126
- "sqs:DeleteQueue",
127
- "sqs:GetQueueAttributes",
128
- "sqs:SetQueueAttributes",
129
- "sqs:GetQueueUrl",
130
- "sqs:TagQueue",
131
- "sqs:UntagQueue"
132
- ],
133
- "Resource": [
134
- "arn:aws:sqs:*:*:*frigg*",
135
- "arn:aws:sqs:*:*:internal-error-queue-*"
136
- ]
137
- },
138
- {
139
- "Sid": "FriggSNSTopics",
140
- "Effect": "Allow",
141
- "Action": [
142
- "sns:CreateTopic",
143
- "sns:DeleteTopic",
144
- "sns:GetTopicAttributes",
145
- "sns:SetTopicAttributes",
146
- "sns:Subscribe",
147
- "sns:Unsubscribe",
148
- "sns:ListSubscriptionsByTopic",
149
- "sns:TagResource",
150
- "sns:UntagResource"
151
- ],
152
- "Resource": [
153
- "arn:aws:sns:*:*:*frigg*"
154
- ]
155
- },
156
- {
157
- "Sid": "FriggMonitoringAndLogs",
158
- "Effect": "Allow",
159
- "Action": [
160
- "cloudwatch:PutMetricAlarm",
161
- "cloudwatch:DeleteAlarms",
162
- "cloudwatch:DescribeAlarms",
163
- "logs:CreateLogGroup",
164
- "logs:CreateLogStream",
165
- "logs:DeleteLogGroup",
166
- "logs:DescribeLogGroups",
167
- "logs:DescribeLogStreams",
168
- "logs:FilterLogEvents",
169
- "logs:PutLogEvents",
170
- "logs:PutRetentionPolicy"
171
- ],
172
- "Resource": [
173
- "arn:aws:logs:*:*:log-group:/aws/lambda/*frigg*",
174
- "arn:aws:logs:*:*:log-group:/aws/lambda/*frigg*:*",
175
- "arn:aws:cloudwatch:*:*:alarm:*frigg*"
176
- ]
177
- },
178
- {
179
- "Sid": "FriggAPIGateway",
180
- "Effect": "Allow",
181
- "Action": [
182
- "apigateway:POST",
183
- "apigateway:PUT",
184
- "apigateway:DELETE",
185
- "apigateway:GET",
186
- "apigateway:PATCH"
187
- ],
188
- "Resource": [
189
- "arn:aws:apigateway:*::/restapis",
190
- "arn:aws:apigateway:*::/restapis/*",
191
- "arn:aws:apigateway:*::/domainnames",
192
- "arn:aws:apigateway:*::/domainnames/*"
193
- ]
194
- },
195
- {
196
- "Sid": "FriggVPCDeploymentPermissions",
197
- "Effect": "Allow",
198
- "Action": [
199
- "ec2:CreateVpcEndpoint",
200
- "ec2:DeleteVpcEndpoint",
201
- "ec2:DescribeVpcEndpoints",
202
- "ec2:ModifyVpcEndpoint",
203
- "ec2:CreateNatGateway",
204
- "ec2:DeleteNatGateway",
205
- "ec2:DescribeNatGateways",
206
- "ec2:AllocateAddress",
207
- "ec2:ReleaseAddress",
208
- "ec2:DescribeAddresses",
209
- "ec2:CreateRouteTable",
210
- "ec2:DeleteRouteTable",
211
- "ec2:DescribeRouteTables",
212
- "ec2:CreateRoute",
213
- "ec2:DeleteRoute",
214
- "ec2:AssociateRouteTable",
215
- "ec2:DisassociateRouteTable",
216
- "ec2:CreateSecurityGroup",
217
- "ec2:DeleteSecurityGroup",
218
- "ec2:AuthorizeSecurityGroupEgress",
219
- "ec2:AuthorizeSecurityGroupIngress",
220
- "ec2:RevokeSecurityGroupEgress",
221
- "ec2:RevokeSecurityGroupIngress",
222
- "ec2:CreateTags",
223
- "ec2:DeleteTags",
224
- "ec2:DescribeTags"
225
- ],
226
- "Resource": "*",
227
- "Condition": {
228
- "StringLike": {
229
- "aws:RequestTag/Name": "*frigg*"
230
- }
231
- }
232
- },
233
- {
234
- "Sid": "FriggKMSEncryptionPermissions",
235
- "Effect": "Allow",
236
- "Action": [
237
- "kms:GenerateDataKey",
238
- "kms:Decrypt"
239
- ],
240
- "Resource": [
241
- "arn:aws:kms:*:*:key/*"
242
- ],
243
- "Condition": {
244
- "StringEquals": {
245
- "kms:ViaService": [
246
- "lambda.*.amazonaws.com",
247
- "s3.*.amazonaws.com"
248
- ]
249
- }
250
- }
251
- },
252
- {
253
- "Sid": "FriggSSMParameterAccess",
254
- "Effect": "Allow",
255
- "Action": [
256
- "ssm:GetParameter",
257
- "ssm:GetParameters",
258
- "ssm:GetParametersByPath"
259
- ],
260
- "Resource": [
261
- "arn:aws:ssm:*:*:parameter/*frigg*",
262
- "arn:aws:ssm:*:*:parameter/*frigg*/*"
263
- ]
264
- }
265
- ]
266
- }