@friggframework/devtools 2.0.0--canary.606.7d3473f.0 → 2.0.0--canary.608.ba60ba6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/frigg-cli/package.json +2 -2
  2. package/infrastructure/domains/integration/integration-builder.js +115 -0
  3. package/infrastructure/domains/integration/integration-builder.test.js +217 -100
  4. package/infrastructure/domains/security/iam-generator.js +14 -5
  5. package/infrastructure/domains/security/iam-generator.test.js +38 -19
  6. package/infrastructure/domains/security/templates/frigg-deployment-iam-stack.yaml +399 -384
  7. package/infrastructure/domains/shared/utilities/base-definition-factory.js +105 -55
  8. package/infrastructure/domains/shared/utilities/base-definition-factory.test.js +79 -27
  9. package/package.json +7 -7
package/infrastructure/domains/security/templates/frigg-deployment-iam-stack.yaml CHANGED
@@ -2,400 +2,415 @@ AWSTemplateFormatVersion: '2010-09-09'
2
2
  Description: 'IAM roles and policies for Frigg application deployment pipeline'
3
3
 
4
4
  Parameters:
5
- DeploymentUserName:
6
- Type: String
7
- Default: 'frigg-deployment-user'
8
- Description: 'Name for the IAM user that will deploy Frigg applications'
9
-
10
- EnableVPCSupport:
11
- Type: String
12
- Default: 'true'
13
- AllowedValues: ['true', 'false']
14
- Description: 'Enable VPC-related permissions for Frigg applications'
15
-
16
- EnableKMSSupport:
17
- Type: String
18
- Default: 'true'
19
- AllowedValues: ['true', 'false']
20
- Description: 'Enable KMS encryption permissions for Frigg applications'
21
-
22
- EnableSSMSupport:
23
- Type: String
24
- Default: 'true'
25
- AllowedValues: ['true', 'false']
26
- Description: 'Enable SSM Parameter Store permissions for Frigg applications'
5
+ DeploymentUserName:
6
+ Type: String
7
+ Default: 'frigg-deployment-user'
8
+ Description: 'Name for the IAM user that will deploy Frigg applications'
9
+
10
+ EnableVPCSupport:
11
+ Type: String
12
+ Default: 'true'
13
+ AllowedValues: ['true', 'false']
14
+ Description: 'Enable VPC-related permissions for Frigg applications'
15
+
16
+ EnableKMSSupport:
17
+ Type: String
18
+ Default: 'true'
19
+ AllowedValues: ['true', 'false']
20
+ Description: 'Enable KMS encryption permissions for Frigg applications'
21
+
22
+ EnableSSMSupport:
23
+ Type: String
24
+ Default: 'true'
25
+ AllowedValues: ['true', 'false']
26
+ Description: 'Enable SSM Parameter Store permissions for Frigg applications'
27
27
 
28
28
  Conditions:
29
- CreateVPCPermissions: !Equals [!Ref EnableVPCSupport, 'true']
30
- CreateKMSPermissions: !Equals [!Ref EnableKMSSupport, 'true']
31
- CreateSSMPermissions: !Equals [!Ref EnableSSMSupport, 'true']
29
+ CreateVPCPermissions: !Equals [!Ref EnableVPCSupport, 'true']
30
+ CreateKMSPermissions: !Equals [!Ref EnableKMSSupport, 'true']
31
+ CreateSSMPermissions: !Equals [!Ref EnableSSMSupport, 'true']
32
32
 
33
33
  Resources:
34
- # IAM User for deployment
35
- FriggDeploymentUser:
36
- Type: AWS::IAM::User
37
- Properties:
38
- UserName: !Ref DeploymentUserName
39
- ManagedPolicyArns:
40
- - !Ref FriggDiscoveryPolicy
41
- - !Ref FriggCoreDeploymentPolicy
42
- - !If [CreateVPCPermissions, !Ref FriggVPCPolicy, !Ref 'AWS::NoValue']
43
- - !If [CreateKMSPermissions, !Ref FriggKMSPolicy, !Ref 'AWS::NoValue']
44
- - !If [CreateSSMPermissions, !Ref FriggSSMPolicy, !Ref 'AWS::NoValue']
34
+ # IAM User for deployment
35
+ FriggDeploymentUser:
36
+ Type: AWS::IAM::User
37
+ Properties:
38
+ UserName: !Ref DeploymentUserName
39
+ ManagedPolicyArns:
40
+ - !Ref FriggDiscoveryPolicy
41
+ - !Ref FriggCoreDeploymentPolicy
42
+ - !If [
43
+ CreateVPCPermissions,
44
+ !Ref FriggVPCPolicy,
45
+ !Ref 'AWS::NoValue',
46
+ ]
47
+ - !If [
48
+ CreateKMSPermissions,
49
+ !Ref FriggKMSPolicy,
50
+ !Ref 'AWS::NoValue',
51
+ ]
52
+ - !If [
53
+ CreateSSMPermissions,
54
+ !Ref FriggSSMPolicy,
55
+ !Ref 'AWS::NoValue',
56
+ ]
57
+
58
+ # Access key for the deployment user
59
+ FriggDeploymentAccessKey:
60
+ Type: AWS::IAM::AccessKey
61
+ Properties:
62
+ UserName: !Ref FriggDeploymentUser
63
+
64
+ # Discovery-time permissions (required for build process)
65
+ FriggDiscoveryPolicy:
66
+ Type: AWS::IAM::ManagedPolicy
67
+ Properties:
68
+ ManagedPolicyName: 'FriggDiscoveryPolicy'
69
+ Description: 'Permissions for AWS resource discovery during Frigg build process'
70
+ PolicyDocument:
71
+ Version: '2012-10-17'
72
+ Statement:
73
+ - Sid: 'AWSDiscoveryPermissions'
74
+ Effect: Allow
75
+ Action:
76
+ - 'sts:GetCallerIdentity'
77
+ - 'ec2:DescribeVpcs'
78
+ - 'ec2:DescribeSubnets'
79
+ - 'ec2:DescribeSecurityGroups'
80
+ - 'ec2:DescribeRouteTables'
81
+ - 'kms:ListKeys'
82
+ - 'kms:DescribeKey'
83
+ Resource: '*'
84
+
85
+ # Core deployment permissions
86
+ FriggCoreDeploymentPolicy:
87
+ Type: AWS::IAM::ManagedPolicy
88
+ Properties:
89
+ ManagedPolicyName: 'FriggCoreDeploymentPolicy'
90
+ Description: 'Core permissions for deploying Frigg applications'
91
+ PolicyDocument:
92
+ Version: '2012-10-17'
93
+ Statement:
94
+ # CloudFormation permissions
95
+ - Sid: 'CloudFormationFriggStacks'
96
+ Effect: Allow
97
+ Action:
98
+ - 'cloudformation:CreateStack'
99
+ - 'cloudformation:UpdateStack'
100
+ - 'cloudformation:DeleteStack'
101
+ - 'cloudformation:DescribeStacks'
102
+ - 'cloudformation:DescribeStackEvents'
103
+ - 'cloudformation:DescribeStackResources'
104
+ - 'cloudformation:DescribeStackResource'
105
+ - 'cloudformation:ListStackResources'
106
+ - 'cloudformation:GetTemplate'
107
+ - 'cloudformation:DescribeChangeSet'
108
+ - 'cloudformation:CreateChangeSet'
109
+ - 'cloudformation:DeleteChangeSet'
110
+ - 'cloudformation:ExecuteChangeSet'
111
+ Resource:
112
+ - !Sub 'arn:aws:cloudformation:*:${AWS::AccountId}:stack/*frigg*/*'
113
+
114
+ # ValidateTemplate needs to be allowed on all resources
115
+ - Sid: 'CloudFormationValidateTemplate'
116
+ Effect: Allow
117
+ Action:
118
+ - 'cloudformation:ValidateTemplate'
119
+ Resource: '*'
120
+
121
+ # S3 deployment bucket permissions
122
+ - Sid: 'S3DeploymentBucket'
123
+ Effect: Allow
124
+ Action:
125
+ - 's3:CreateBucket'
126
+ - 's3:PutObject'
127
+ - 's3:GetObject'
128
+ - 's3:DeleteObject'
129
+ - 's3:PutBucketPolicy'
130
+ - 's3:PutBucketVersioning'
131
+ - 's3:PutBucketPublicAccessBlock'
132
+ - 's3:GetBucketLocation'
133
+ - 's3:ListBucket'
134
+ - 's3:PutBucketTagging'
135
+ - 's3:GetBucketTagging'
136
+ Resource:
137
+ - 'arn:aws:s3:::*serverless*'
138
+ - 'arn:aws:s3:::*serverless*/*'
139
+
140
+ # Lambda function permissions
141
+ - Sid: 'LambdaFriggFunctions'
142
+ Effect: Allow
143
+ Action:
144
+ - 'lambda:CreateFunction'
145
+ - 'lambda:UpdateFunctionCode'
146
+ - 'lambda:UpdateFunctionConfiguration'
147
+ - 'lambda:DeleteFunction'
148
+ - 'lambda:GetFunction'
149
+ - 'lambda:ListFunctions'
150
+ - 'lambda:PublishVersion'
151
+ - 'lambda:CreateAlias'
152
+ - 'lambda:UpdateAlias'
153
+ - 'lambda:DeleteAlias'
154
+ - 'lambda:GetAlias'
155
+ - 'lambda:AddPermission'
156
+ - 'lambda:RemovePermission'
157
+ - 'lambda:GetPolicy'
158
+ - 'lambda:PutProvisionedConcurrencyConfig'
159
+ - 'lambda:DeleteProvisionedConcurrencyConfig'
160
+ - 'lambda:PutConcurrency'
161
+ - 'lambda:DeleteConcurrency'
162
+ - 'lambda:TagResource'
163
+ - 'lambda:UntagResource'
164
+ - 'lambda:ListVersionsByFunction'
165
+ Resource:
166
+ - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:function:*frigg*'
45
167
 
46
- # Access key for the deployment user
47
- FriggDeploymentAccessKey:
48
- Type: AWS::IAM::AccessKey
49
- Properties:
50
- UserName: !Ref FriggDeploymentUser
168
+ # Lambda EventSourceMapping permissions
169
+ - Sid: 'FriggLambdaEventSourceMapping'
170
+ Effect: Allow
171
+ Action:
172
+ - 'lambda:CreateEventSourceMapping'
173
+ - 'lambda:DeleteEventSourceMapping'
174
+ - 'lambda:GetEventSourceMapping'
175
+ - 'lambda:UpdateEventSourceMapping'
176
+ - 'lambda:ListEventSourceMappings'
177
+ Resource:
178
+ - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:event-source-mapping:*'
51
179
 
52
- # Discovery-time permissions (required for build process)
53
- FriggDiscoveryPolicy:
54
- Type: AWS::IAM::ManagedPolicy
55
- Properties:
56
- ManagedPolicyName: 'FriggDiscoveryPolicy'
57
- Description: 'Permissions for AWS resource discovery during Frigg build process'
58
- PolicyDocument:
59
- Version: '2012-10-17'
60
- Statement:
61
- - Sid: 'AWSDiscoveryPermissions'
62
- Effect: Allow
63
- Action:
64
- - 'sts:GetCallerIdentity'
65
- - 'ec2:DescribeVpcs'
66
- - 'ec2:DescribeSubnets'
67
- - 'ec2:DescribeSecurityGroups'
68
- - 'ec2:DescribeRouteTables'
69
- - 'kms:ListKeys'
70
- - 'kms:DescribeKey'
71
- Resource: '*'
180
+ # IAM role permissions
181
+ - Sid: 'IAMRolesForFriggLambda'
182
+ Effect: Allow
183
+ Action:
184
+ - 'iam:CreateRole'
185
+ - 'iam:DeleteRole'
186
+ - 'iam:GetRole'
187
+ - 'iam:PassRole'
188
+ - 'iam:PutRolePolicy'
189
+ - 'iam:DeleteRolePolicy'
190
+ - 'iam:GetRolePolicy'
191
+ - 'iam:AttachRolePolicy'
192
+ - 'iam:DetachRolePolicy'
193
+ - 'iam:TagRole'
194
+ - 'iam:UntagRole'
195
+ Resource:
196
+ - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*'
197
+ - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*LambdaRole*'
72
198
 
73
- # Core deployment permissions
74
- FriggCoreDeploymentPolicy:
75
- Type: AWS::IAM::ManagedPolicy
76
- Properties:
77
- ManagedPolicyName: 'FriggCoreDeploymentPolicy'
78
- Description: 'Core permissions for deploying Frigg applications'
79
- PolicyDocument:
80
- Version: '2012-10-17'
81
- Statement:
82
- # CloudFormation permissions
83
- - Sid: 'CloudFormationFriggStacks'
84
- Effect: Allow
85
- Action:
86
- - 'cloudformation:CreateStack'
87
- - 'cloudformation:UpdateStack'
88
- - 'cloudformation:DeleteStack'
89
- - 'cloudformation:DescribeStacks'
90
- - 'cloudformation:DescribeStackEvents'
91
- - 'cloudformation:DescribeStackResources'
92
- - 'cloudformation:DescribeStackResource'
93
- - 'cloudformation:ListStackResources'
94
- - 'cloudformation:GetTemplate'
95
- - 'cloudformation:DescribeChangeSet'
96
- - 'cloudformation:CreateChangeSet'
97
- - 'cloudformation:DeleteChangeSet'
98
- - 'cloudformation:ExecuteChangeSet'
99
- Resource:
100
- - !Sub 'arn:aws:cloudformation:*:${AWS::AccountId}:stack/*frigg*/*'
101
-
102
- # ValidateTemplate needs to be allowed on all resources
103
- - Sid: 'CloudFormationValidateTemplate'
104
- Effect: Allow
105
- Action:
106
- - 'cloudformation:ValidateTemplate'
107
- Resource: '*'
108
-
109
- # S3 deployment bucket permissions
110
- - Sid: 'S3DeploymentBucket'
111
- Effect: Allow
112
- Action:
113
- - 's3:CreateBucket'
114
- - 's3:PutObject'
115
- - 's3:GetObject'
116
- - 's3:DeleteObject'
117
- - 's3:PutBucketPolicy'
118
- - 's3:PutBucketVersioning'
119
- - 's3:PutBucketPublicAccessBlock'
120
- - 's3:GetBucketLocation'
121
- - 's3:ListBucket'
122
- - 's3:PutBucketTagging'
123
- - 's3:GetBucketTagging'
124
- Resource:
125
- - 'arn:aws:s3:::*serverless*'
126
- - 'arn:aws:s3:::*serverless*/*'
127
-
128
- # Lambda function permissions
129
- - Sid: 'LambdaFriggFunctions'
130
- Effect: Allow
131
- Action:
132
- - 'lambda:CreateFunction'
133
- - 'lambda:UpdateFunctionCode'
134
- - 'lambda:UpdateFunctionConfiguration'
135
- - 'lambda:DeleteFunction'
136
- - 'lambda:GetFunction'
137
- - 'lambda:ListFunctions'
138
- - 'lambda:PublishVersion'
139
- - 'lambda:CreateAlias'
140
- - 'lambda:UpdateAlias'
141
- - 'lambda:DeleteAlias'
142
- - 'lambda:GetAlias'
143
- - 'lambda:AddPermission'
144
- - 'lambda:RemovePermission'
145
- - 'lambda:GetPolicy'
146
- - 'lambda:PutProvisionedConcurrencyConfig'
147
- - 'lambda:DeleteProvisionedConcurrencyConfig'
148
- - 'lambda:PutConcurrency'
149
- - 'lambda:DeleteConcurrency'
150
- - 'lambda:TagResource'
151
- - 'lambda:UntagResource'
152
- - 'lambda:ListVersionsByFunction'
153
- Resource:
154
- - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:function:*frigg*'
155
-
156
- # Lambda EventSourceMapping permissions
157
- - Sid: 'FriggLambdaEventSourceMapping'
158
- Effect: Allow
159
- Action:
160
- - 'lambda:CreateEventSourceMapping'
161
- - 'lambda:DeleteEventSourceMapping'
162
- - 'lambda:GetEventSourceMapping'
163
- - 'lambda:UpdateEventSourceMapping'
164
- - 'lambda:ListEventSourceMappings'
165
- Resource:
166
- - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:event-source-mapping:*'
167
-
168
- # IAM role permissions
169
- - Sid: 'IAMRolesForFriggLambda'
170
- Effect: Allow
171
- Action:
172
- - 'iam:CreateRole'
173
- - 'iam:DeleteRole'
174
- - 'iam:GetRole'
175
- - 'iam:PassRole'
176
- - 'iam:PutRolePolicy'
177
- - 'iam:DeleteRolePolicy'
178
- - 'iam:GetRolePolicy'
179
- - 'iam:AttachRolePolicy'
180
- - 'iam:DetachRolePolicy'
181
- - 'iam:TagRole'
182
- - 'iam:UntagRole'
183
- Resource:
184
- - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*'
185
- - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*LambdaRole*'
186
-
187
- # IAM policy permissions
188
- - Sid: 'IAMPolicyVersionPermissions'
189
- Effect: Allow
190
- Action:
191
- - 'iam:ListPolicyVersions'
192
- Resource:
193
- - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/*'
194
-
195
- # SQS permissions
196
- - Sid: 'FriggMessagingServices'
197
- Effect: Allow
198
- Action:
199
- - 'sqs:CreateQueue'
200
- - 'sqs:DeleteQueue'
201
- - 'sqs:GetQueueAttributes'
202
- - 'sqs:SetQueueAttributes'
203
- - 'sqs:GetQueueUrl'
204
- - 'sqs:TagQueue'
205
- - 'sqs:UntagQueue'
206
- Resource:
207
- - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*frigg*'
208
- - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:internal-error-queue-*'
209
-
210
- # SNS permissions
211
- - Sid: 'FriggSNSTopics'
212
- Effect: Allow
213
- Action:
214
- - 'sns:CreateTopic'
215
- - 'sns:DeleteTopic'
216
- - 'sns:GetTopicAttributes'
217
- - 'sns:SetTopicAttributes'
218
- - 'sns:Subscribe'
219
- - 'sns:Unsubscribe'
220
- - 'sns:ListSubscriptionsByTopic'
221
- - 'sns:TagResource'
222
- - 'sns:UntagResource'
223
- Resource:
224
- - !Sub 'arn:aws:sns:*:${AWS::AccountId}:*frigg*'
225
-
226
- # CloudWatch and Logs permissions
227
- - Sid: 'FriggMonitoringAndLogs'
228
- Effect: Allow
229
- Action:
230
- - 'cloudwatch:PutMetricAlarm'
231
- - 'cloudwatch:DeleteAlarms'
232
- - 'cloudwatch:DescribeAlarms'
233
- - 'logs:CreateLogGroup'
234
- - 'logs:CreateLogStream'
235
- - 'logs:DeleteLogGroup'
236
- - 'logs:DescribeLogGroups'
237
- - 'logs:DescribeLogStreams'
238
- - 'logs:FilterLogEvents'
239
- - 'logs:PutLogEvents'
240
- - 'logs:PutRetentionPolicy'
241
- Resource:
242
- - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*'
243
- - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*:*'
244
- - !Sub 'arn:aws:cloudwatch:*:${AWS::AccountId}:alarm:*frigg*'
245
-
246
- # API Gateway permissions
247
- - Sid: 'FriggAPIGateway'
248
- Effect: Allow
249
- Action:
250
- - 'apigateway:POST'
251
- - 'apigateway:PUT'
252
- - 'apigateway:DELETE'
253
- - 'apigateway:GET'
254
- - 'apigateway:PATCH'
255
- Resource:
256
- - 'arn:aws:apigateway:*::/restapis'
257
- - 'arn:aws:apigateway:*::/restapis/*'
258
- - 'arn:aws:apigateway:*::/domainnames'
259
- - 'arn:aws:apigateway:*::/domainnames/*'
260
-
261
- # API Gateway v2 permissions
262
- - Sid: 'FriggAPIGatewayV2'
263
- Effect: Allow
264
- Action:
265
- - 'apigateway:GET'
266
- - 'apigateway:DELETE'
267
- - 'apigateway:PATCH'
268
- - 'apigateway:POST'
269
- - 'apigateway:PUT'
270
- Resource:
271
- - 'arn:aws:apigateway:*::/apis'
272
- - 'arn:aws:apigateway:*::/apis/*'
273
- - 'arn:aws:apigateway:*::/apis/*/stages'
274
- - 'arn:aws:apigateway:*::/apis/*/stages/*'
275
- - 'arn:aws:apigateway:*::/apis/*/mappings'
276
- - 'arn:aws:apigateway:*::/apis/*/mappings/*'
277
- - 'arn:aws:apigateway:*::/domainnames'
278
- - 'arn:aws:apigateway:*::/domainnames/*'
279
- - 'arn:aws:apigateway:*::/domainnames/*/apimappings'
199
+ # IAM policy permissions
200
+ - Sid: 'IAMPolicyVersionPermissions'
201
+ Effect: Allow
202
+ Action:
203
+ - 'iam:ListPolicyVersions'
204
+ Resource:
205
+ - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/*'
280
206
 
281
- # VPC-specific permissions
282
- FriggVPCPolicy:
283
- Type: AWS::IAM::ManagedPolicy
284
- Condition: CreateVPCPermissions
285
- Properties:
286
- ManagedPolicyName: 'FriggVPCPolicy'
287
- Description: 'VPC-related permissions for Frigg applications'
288
- PolicyDocument:
289
- Version: '2012-10-17'
290
- Statement:
291
- - Sid: 'FriggVPCEndpointManagement'
292
- Effect: Allow
293
- Action:
294
- - 'ec2:CreateVpcEndpoint'
295
- - 'ec2:DeleteVpcEndpoints'
296
- - 'ec2:DescribeVpcEndpoints'
297
- - 'ec2:ModifyVpcEndpoint'
298
- - 'ec2:CreateNatGateway'
299
- - 'ec2:DeleteNatGateway'
300
- - 'ec2:DescribeNatGateways'
301
- - 'ec2:AllocateAddress'
302
- - 'ec2:ReleaseAddress'
303
- - 'ec2:DescribeAddresses'
304
- - 'ec2:CreateRouteTable'
305
- - 'ec2:DeleteRouteTable'
306
- - 'ec2:DescribeRouteTables'
307
- - 'ec2:CreateRoute'
308
- - 'ec2:DeleteRoute'
309
- - 'ec2:AssociateRouteTable'
310
- - 'ec2:DisassociateRouteTable'
311
- - 'ec2:CreateSecurityGroup'
312
- - 'ec2:DeleteSecurityGroup'
313
- - 'ec2:AuthorizeSecurityGroupEgress'
314
- - 'ec2:AuthorizeSecurityGroupIngress'
315
- - 'ec2:RevokeSecurityGroupEgress'
316
- - 'ec2:RevokeSecurityGroupIngress'
317
- - 'ec2:CreateTags'
318
- - 'ec2:DeleteTags'
319
- - 'ec2:DescribeTags'
320
- - 'ec2:DetachInternetGateway'
321
- - 'ec2:DeleteSubnet'
322
- Resource: '*'
207
+ # SQS permissions
208
+ - Sid: 'FriggMessagingServices'
209
+ Effect: Allow
210
+ Action:
211
+ - 'sqs:CreateQueue'
212
+ - 'sqs:DeleteQueue'
213
+ - 'sqs:GetQueueAttributes'
214
+ - 'sqs:SetQueueAttributes'
215
+ - 'sqs:GetQueueUrl'
216
+ - 'sqs:TagQueue'
217
+ - 'sqs:UntagQueue'
218
+ Resource:
219
+ - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*frigg*'
220
+ # Case-sensitive glob: the app-level FIFO queue is named
221
+ # "...-FriggUserActionQueue.fifo" which "*frigg*" would not match.
222
+ - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*Frigg*'
223
+ - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:internal-error-queue-*'
323
224
 
324
- # KMS permissions
325
- FriggKMSPolicy:
326
- Type: AWS::IAM::ManagedPolicy
327
- Condition: CreateKMSPermissions
328
- Properties:
329
- ManagedPolicyName: 'FriggKMSPolicy'
330
- Description: 'KMS encryption permissions for Frigg applications'
331
- PolicyDocument:
332
- Version: '2012-10-17'
333
- Statement:
334
- - Sid: 'FriggKMSEncryptionRuntime'
335
- Effect: Allow
336
- Action:
337
- - 'kms:GenerateDataKey'
338
- - 'kms:Decrypt'
339
- Resource:
340
- - !Sub 'arn:aws:kms:*:${AWS::AccountId}:key/*'
341
- Condition:
342
- StringEquals:
343
- 'kms:ViaService':
344
- - 'lambda.*.amazonaws.com'
345
- - 's3.*.amazonaws.com'
225
+ # SNS permissions
226
+ - Sid: 'FriggSNSTopics'
227
+ Effect: Allow
228
+ Action:
229
+ - 'sns:CreateTopic'
230
+ - 'sns:DeleteTopic'
231
+ - 'sns:GetTopicAttributes'
232
+ - 'sns:SetTopicAttributes'
233
+ - 'sns:Subscribe'
234
+ - 'sns:Unsubscribe'
235
+ - 'sns:ListSubscriptionsByTopic'
236
+ - 'sns:TagResource'
237
+ - 'sns:UntagResource'
238
+ Resource:
239
+ - !Sub 'arn:aws:sns:*:${AWS::AccountId}:*frigg*'
346
240
 
347
- # SSM Parameter Store permissions
348
- FriggSSMPolicy:
349
- Type: AWS::IAM::ManagedPolicy
350
- Condition: CreateSSMPermissions
351
- Properties:
352
- ManagedPolicyName: 'FriggSSMPolicy'
353
- Description: 'SSM Parameter Store permissions for Frigg applications'
354
- PolicyDocument:
355
- Version: '2012-10-17'
356
- Statement:
357
- - Sid: 'FriggSSMParameterAccess'
358
- Effect: Allow
359
- Action:
360
- - 'ssm:GetParameter'
361
- - 'ssm:GetParameters'
362
- - 'ssm:GetParametersByPath'
363
- Resource:
364
- - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*'
365
- - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*/*'
241
+ # CloudWatch and Logs permissions
242
+ - Sid: 'FriggMonitoringAndLogs'
243
+ Effect: Allow
244
+ Action:
245
+ - 'cloudwatch:PutMetricAlarm'
246
+ - 'cloudwatch:DeleteAlarms'
247
+ - 'cloudwatch:DescribeAlarms'
248
+ - 'logs:CreateLogGroup'
249
+ - 'logs:CreateLogStream'
250
+ - 'logs:DeleteLogGroup'
251
+ - 'logs:DescribeLogGroups'
252
+ - 'logs:DescribeLogStreams'
253
+ - 'logs:FilterLogEvents'
254
+ - 'logs:PutLogEvents'
255
+ - 'logs:PutRetentionPolicy'
256
+ Resource:
257
+ - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*'
258
+ - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*:*'
259
+ - !Sub 'arn:aws:cloudwatch:*:${AWS::AccountId}:alarm:*frigg*'
366
260
 
367
- # Store access key in Secrets Manager
368
- FriggDeploymentCredentials:
369
- Type: AWS::SecretsManager::Secret
370
- Properties:
371
- Name: 'frigg-deployment-credentials'
372
- Description: 'Access credentials for Frigg deployment user'
373
- SecretString: !Sub |
374
- {
375
- "AccessKeyId": "${FriggDeploymentAccessKey}",
376
- "SecretAccessKey": "${FriggDeploymentAccessKey.SecretAccessKey}"
377
- }
261
+ # API Gateway permissions
262
+ - Sid: 'FriggAPIGateway'
263
+ Effect: Allow
264
+ Action:
265
+ - 'apigateway:POST'
266
+ - 'apigateway:PUT'
267
+ - 'apigateway:DELETE'
268
+ - 'apigateway:GET'
269
+ - 'apigateway:PATCH'
270
+ Resource:
271
+ - 'arn:aws:apigateway:*::/restapis'
272
+ - 'arn:aws:apigateway:*::/restapis/*'
273
+ - 'arn:aws:apigateway:*::/domainnames'
274
+ - 'arn:aws:apigateway:*::/domainnames/*'
275
+
276
+ # API Gateway v2 permissions
277
+ - Sid: 'FriggAPIGatewayV2'
278
+ Effect: Allow
279
+ Action:
280
+ - 'apigateway:GET'
281
+ - 'apigateway:DELETE'
282
+ - 'apigateway:PATCH'
283
+ - 'apigateway:POST'
284
+ - 'apigateway:PUT'
285
+ Resource:
286
+ - 'arn:aws:apigateway:*::/apis'
287
+ - 'arn:aws:apigateway:*::/apis/*'
288
+ - 'arn:aws:apigateway:*::/apis/*/stages'
289
+ - 'arn:aws:apigateway:*::/apis/*/stages/*'
290
+ - 'arn:aws:apigateway:*::/apis/*/mappings'
291
+ - 'arn:aws:apigateway:*::/apis/*/mappings/*'
292
+ - 'arn:aws:apigateway:*::/domainnames'
293
+ - 'arn:aws:apigateway:*::/domainnames/*'
294
+ - 'arn:aws:apigateway:*::/domainnames/*/apimappings'
295
+
296
+ # VPC-specific permissions
297
+ FriggVPCPolicy:
298
+ Type: AWS::IAM::ManagedPolicy
299
+ Condition: CreateVPCPermissions
300
+ Properties:
301
+ ManagedPolicyName: 'FriggVPCPolicy'
302
+ Description: 'VPC-related permissions for Frigg applications'
303
+ PolicyDocument:
304
+ Version: '2012-10-17'
305
+ Statement:
306
+ - Sid: 'FriggVPCEndpointManagement'
307
+ Effect: Allow
308
+ Action:
309
+ - 'ec2:CreateVpcEndpoint'
310
+ - 'ec2:DeleteVpcEndpoints'
311
+ - 'ec2:DescribeVpcEndpoints'
312
+ - 'ec2:ModifyVpcEndpoint'
313
+ - 'ec2:CreateNatGateway'
314
+ - 'ec2:DeleteNatGateway'
315
+ - 'ec2:DescribeNatGateways'
316
+ - 'ec2:AllocateAddress'
317
+ - 'ec2:ReleaseAddress'
318
+ - 'ec2:DescribeAddresses'
319
+ - 'ec2:CreateRouteTable'
320
+ - 'ec2:DeleteRouteTable'
321
+ - 'ec2:DescribeRouteTables'
322
+ - 'ec2:CreateRoute'
323
+ - 'ec2:DeleteRoute'
324
+ - 'ec2:AssociateRouteTable'
325
+ - 'ec2:DisassociateRouteTable'
326
+ - 'ec2:CreateSecurityGroup'
327
+ - 'ec2:DeleteSecurityGroup'
328
+ - 'ec2:AuthorizeSecurityGroupEgress'
329
+ - 'ec2:AuthorizeSecurityGroupIngress'
330
+ - 'ec2:RevokeSecurityGroupEgress'
331
+ - 'ec2:RevokeSecurityGroupIngress'
332
+ - 'ec2:CreateTags'
333
+ - 'ec2:DeleteTags'
334
+ - 'ec2:DescribeTags'
335
+ - 'ec2:DetachInternetGateway'
336
+ - 'ec2:DeleteSubnet'
337
+ Resource: '*'
338
+
339
+ # KMS permissions
340
+ FriggKMSPolicy:
341
+ Type: AWS::IAM::ManagedPolicy
342
+ Condition: CreateKMSPermissions
343
+ Properties:
344
+ ManagedPolicyName: 'FriggKMSPolicy'
345
+ Description: 'KMS encryption permissions for Frigg applications'
346
+ PolicyDocument:
347
+ Version: '2012-10-17'
348
+ Statement:
349
+ - Sid: 'FriggKMSEncryptionRuntime'
350
+ Effect: Allow
351
+ Action:
352
+ - 'kms:GenerateDataKey'
353
+ - 'kms:Decrypt'
354
+ Resource:
355
+ - !Sub 'arn:aws:kms:*:${AWS::AccountId}:key/*'
356
+ Condition:
357
+ StringEquals:
358
+ 'kms:ViaService':
359
+ - 'lambda.*.amazonaws.com'
360
+ - 's3.*.amazonaws.com'
361
+
362
+ # SSM Parameter Store permissions
363
+ FriggSSMPolicy:
364
+ Type: AWS::IAM::ManagedPolicy
365
+ Condition: CreateSSMPermissions
366
+ Properties:
367
+ ManagedPolicyName: 'FriggSSMPolicy'
368
+ Description: 'SSM Parameter Store permissions for Frigg applications'
369
+ PolicyDocument:
370
+ Version: '2012-10-17'
371
+ Statement:
372
+ - Sid: 'FriggSSMParameterAccess'
373
+ Effect: Allow
374
+ Action:
375
+ - 'ssm:GetParameter'
376
+ - 'ssm:GetParameters'
377
+ - 'ssm:GetParametersByPath'
378
+ Resource:
379
+ - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*'
380
+ - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*/*'
381
+
382
+ # Store access key in Secrets Manager
383
+ FriggDeploymentCredentials:
384
+ Type: AWS::SecretsManager::Secret
385
+ Properties:
386
+ Name: 'frigg-deployment-credentials'
387
+ Description: 'Access credentials for Frigg deployment user'
388
+ SecretString: !Sub |
389
+ {
390
+ "AccessKeyId": "${FriggDeploymentAccessKey}",
391
+ "SecretAccessKey": "${FriggDeploymentAccessKey.SecretAccessKey}"
392
+ }
378
393
 
379
394
  Outputs:
380
- DeploymentUserArn:
381
- Description: 'ARN of the Frigg deployment user'
382
- Value: !GetAtt FriggDeploymentUser.Arn
383
- Export:
384
- Name: !Sub '${AWS::StackName}-UserArn'
385
-
386
- AccessKeyId:
387
- Description: 'Access Key ID for the deployment user'
388
- Value: !Ref FriggDeploymentAccessKey
389
- Export:
390
- Name: !Sub '${AWS::StackName}-AccessKeyId'
391
-
392
- SecretAccessKeyCommand:
393
- Description: 'Command to retrieve the secret access key'
394
- Value: !Sub |
395
- aws secretsmanager get-secret-value --secret-id frigg-deployment-credentials --query SecretString --output text | jq -r .SecretAccessKey
396
-
397
- CredentialsSecretArn:
398
- Description: 'ARN of the secret containing deployment credentials'
399
- Value: !Ref FriggDeploymentCredentials
400
- Export:
401
- Name: !Sub '${AWS::StackName}-CredentialsSecretArn'
395
+ DeploymentUserArn:
396
+ Description: 'ARN of the Frigg deployment user'
397
+ Value: !GetAtt FriggDeploymentUser.Arn
398
+ Export:
399
+ Name: !Sub '${AWS::StackName}-UserArn'
400
+
401
+ AccessKeyId:
402
+ Description: 'Access Key ID for the deployment user'
403
+ Value: !Ref FriggDeploymentAccessKey
404
+ Export:
405
+ Name: !Sub '${AWS::StackName}-AccessKeyId'
406
+
407
+ SecretAccessKeyCommand:
408
+ Description: 'Command to retrieve the secret access key'
409
+ Value: !Sub |
410
+ aws secretsmanager get-secret-value --secret-id frigg-deployment-credentials --query SecretString --output text | jq -r .SecretAccessKey
411
+
412
+ CredentialsSecretArn:
413
+ Description: 'ARN of the secret containing deployment credentials'
414
+ Value: !Ref FriggDeploymentCredentials
415
+ Export:
416
+ Name: !Sub '${AWS::StackName}-CredentialsSecretArn'