@friggframework/devtools 2.0.0--canary.608.ba60ba6.0 → 2.0.0--canary.608.03436383054a.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/infrastructure/domains/integration/integration-builder.js +2 -10
  2. package/infrastructure/domains/integration/integration-builder.test.js +100 -97
  3. package/infrastructure/domains/security/iam-generator.js +5 -10
  4. package/infrastructure/domains/security/iam-generator.test.js +19 -22
  5. package/infrastructure/domains/security/templates/frigg-deployment-iam-stack.yaml +387 -399
  6. package/infrastructure/domains/shared/utilities/base-definition-factory.js +59 -95
  7. package/infrastructure/domains/shared/utilities/base-definition-factory.test.js +27 -73
  8. package/package.json +7 -7
package/infrastructure/domains/security/templates/frigg-deployment-iam-stack.yaml CHANGED
@@ -2,415 +2,403 @@ AWSTemplateFormatVersion: '2010-09-09'
2
2
  Description: 'IAM roles and policies for Frigg application deployment pipeline'
3
3
 
4
4
  Parameters:
5
- DeploymentUserName:
6
- Type: String
7
- Default: 'frigg-deployment-user'
8
- Description: 'Name for the IAM user that will deploy Frigg applications'
9
-
10
- EnableVPCSupport:
11
- Type: String
12
- Default: 'true'
13
- AllowedValues: ['true', 'false']
14
- Description: 'Enable VPC-related permissions for Frigg applications'
15
-
16
- EnableKMSSupport:
17
- Type: String
18
- Default: 'true'
19
- AllowedValues: ['true', 'false']
20
- Description: 'Enable KMS encryption permissions for Frigg applications'
21
-
22
- EnableSSMSupport:
23
- Type: String
24
- Default: 'true'
25
- AllowedValues: ['true', 'false']
26
- Description: 'Enable SSM Parameter Store permissions for Frigg applications'
5
+ DeploymentUserName:
6
+ Type: String
7
+ Default: 'frigg-deployment-user'
8
+ Description: 'Name for the IAM user that will deploy Frigg applications'
9
+
10
+ EnableVPCSupport:
11
+ Type: String
12
+ Default: 'true'
13
+ AllowedValues: ['true', 'false']
14
+ Description: 'Enable VPC-related permissions for Frigg applications'
15
+
16
+ EnableKMSSupport:
17
+ Type: String
18
+ Default: 'true'
19
+ AllowedValues: ['true', 'false']
20
+ Description: 'Enable KMS encryption permissions for Frigg applications'
21
+
22
+ EnableSSMSupport:
23
+ Type: String
24
+ Default: 'true'
25
+ AllowedValues: ['true', 'false']
26
+ Description: 'Enable SSM Parameter Store permissions for Frigg applications'
27
27
 
28
28
  Conditions:
29
- CreateVPCPermissions: !Equals [!Ref EnableVPCSupport, 'true']
30
- CreateKMSPermissions: !Equals [!Ref EnableKMSSupport, 'true']
31
- CreateSSMPermissions: !Equals [!Ref EnableSSMSupport, 'true']
29
+ CreateVPCPermissions: !Equals [!Ref EnableVPCSupport, 'true']
30
+ CreateKMSPermissions: !Equals [!Ref EnableKMSSupport, 'true']
31
+ CreateSSMPermissions: !Equals [!Ref EnableSSMSupport, 'true']
32
32
 
33
33
  Resources:
34
- # IAM User for deployment
35
- FriggDeploymentUser:
36
- Type: AWS::IAM::User
37
- Properties:
38
- UserName: !Ref DeploymentUserName
39
- ManagedPolicyArns:
40
- - !Ref FriggDiscoveryPolicy
41
- - !Ref FriggCoreDeploymentPolicy
42
- - !If [
43
- CreateVPCPermissions,
44
- !Ref FriggVPCPolicy,
45
- !Ref 'AWS::NoValue',
46
- ]
47
- - !If [
48
- CreateKMSPermissions,
49
- !Ref FriggKMSPolicy,
50
- !Ref 'AWS::NoValue',
51
- ]
52
- - !If [
53
- CreateSSMPermissions,
54
- !Ref FriggSSMPolicy,
55
- !Ref 'AWS::NoValue',
56
- ]
57
-
58
- # Access key for the deployment user
59
- FriggDeploymentAccessKey:
60
- Type: AWS::IAM::AccessKey
61
- Properties:
62
- UserName: !Ref FriggDeploymentUser
63
-
64
- # Discovery-time permissions (required for build process)
65
- FriggDiscoveryPolicy:
66
- Type: AWS::IAM::ManagedPolicy
67
- Properties:
68
- ManagedPolicyName: 'FriggDiscoveryPolicy'
69
- Description: 'Permissions for AWS resource discovery during Frigg build process'
70
- PolicyDocument:
71
- Version: '2012-10-17'
72
- Statement:
73
- - Sid: 'AWSDiscoveryPermissions'
74
- Effect: Allow
75
- Action:
76
- - 'sts:GetCallerIdentity'
77
- - 'ec2:DescribeVpcs'
78
- - 'ec2:DescribeSubnets'
79
- - 'ec2:DescribeSecurityGroups'
80
- - 'ec2:DescribeRouteTables'
81
- - 'kms:ListKeys'
82
- - 'kms:DescribeKey'
83
- Resource: '*'
84
-
85
- # Core deployment permissions
86
- FriggCoreDeploymentPolicy:
87
- Type: AWS::IAM::ManagedPolicy
88
- Properties:
89
- ManagedPolicyName: 'FriggCoreDeploymentPolicy'
90
- Description: 'Core permissions for deploying Frigg applications'
91
- PolicyDocument:
92
- Version: '2012-10-17'
93
- Statement:
94
- # CloudFormation permissions
95
- - Sid: 'CloudFormationFriggStacks'
96
- Effect: Allow
97
- Action:
98
- - 'cloudformation:CreateStack'
99
- - 'cloudformation:UpdateStack'
100
- - 'cloudformation:DeleteStack'
101
- - 'cloudformation:DescribeStacks'
102
- - 'cloudformation:DescribeStackEvents'
103
- - 'cloudformation:DescribeStackResources'
104
- - 'cloudformation:DescribeStackResource'
105
- - 'cloudformation:ListStackResources'
106
- - 'cloudformation:GetTemplate'
107
- - 'cloudformation:DescribeChangeSet'
108
- - 'cloudformation:CreateChangeSet'
109
- - 'cloudformation:DeleteChangeSet'
110
- - 'cloudformation:ExecuteChangeSet'
111
- Resource:
112
- - !Sub 'arn:aws:cloudformation:*:${AWS::AccountId}:stack/*frigg*/*'
113
-
114
- # ValidateTemplate needs to be allowed on all resources
115
- - Sid: 'CloudFormationValidateTemplate'
116
- Effect: Allow
117
- Action:
118
- - 'cloudformation:ValidateTemplate'
119
- Resource: '*'
120
-
121
- # S3 deployment bucket permissions
122
- - Sid: 'S3DeploymentBucket'
123
- Effect: Allow
124
- Action:
125
- - 's3:CreateBucket'
126
- - 's3:PutObject'
127
- - 's3:GetObject'
128
- - 's3:DeleteObject'
129
- - 's3:PutBucketPolicy'
130
- - 's3:PutBucketVersioning'
131
- - 's3:PutBucketPublicAccessBlock'
132
- - 's3:GetBucketLocation'
133
- - 's3:ListBucket'
134
- - 's3:PutBucketTagging'
135
- - 's3:GetBucketTagging'
136
- Resource:
137
- - 'arn:aws:s3:::*serverless*'
138
- - 'arn:aws:s3:::*serverless*/*'
139
-
140
- # Lambda function permissions
141
- - Sid: 'LambdaFriggFunctions'
142
- Effect: Allow
143
- Action:
144
- - 'lambda:CreateFunction'
145
- - 'lambda:UpdateFunctionCode'
146
- - 'lambda:UpdateFunctionConfiguration'
147
- - 'lambda:DeleteFunction'
148
- - 'lambda:GetFunction'
149
- - 'lambda:ListFunctions'
150
- - 'lambda:PublishVersion'
151
- - 'lambda:CreateAlias'
152
- - 'lambda:UpdateAlias'
153
- - 'lambda:DeleteAlias'
154
- - 'lambda:GetAlias'
155
- - 'lambda:AddPermission'
156
- - 'lambda:RemovePermission'
157
- - 'lambda:GetPolicy'
158
- - 'lambda:PutProvisionedConcurrencyConfig'
159
- - 'lambda:DeleteProvisionedConcurrencyConfig'
160
- - 'lambda:PutConcurrency'
161
- - 'lambda:DeleteConcurrency'
162
- - 'lambda:TagResource'
163
- - 'lambda:UntagResource'
164
- - 'lambda:ListVersionsByFunction'
165
- Resource:
166
- - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:function:*frigg*'
34
+ # IAM User for deployment
35
+ FriggDeploymentUser:
36
+ Type: AWS::IAM::User
37
+ Properties:
38
+ UserName: !Ref DeploymentUserName
39
+ ManagedPolicyArns:
40
+ - !Ref FriggDiscoveryPolicy
41
+ - !Ref FriggCoreDeploymentPolicy
42
+ - !If [CreateVPCPermissions, !Ref FriggVPCPolicy, !Ref 'AWS::NoValue']
43
+ - !If [CreateKMSPermissions, !Ref FriggKMSPolicy, !Ref 'AWS::NoValue']
44
+ - !If [CreateSSMPermissions, !Ref FriggSSMPolicy, !Ref 'AWS::NoValue']
167
45
 
168
- # Lambda EventSourceMapping permissions
169
- - Sid: 'FriggLambdaEventSourceMapping'
170
- Effect: Allow
171
- Action:
172
- - 'lambda:CreateEventSourceMapping'
173
- - 'lambda:DeleteEventSourceMapping'
174
- - 'lambda:GetEventSourceMapping'
175
- - 'lambda:UpdateEventSourceMapping'
176
- - 'lambda:ListEventSourceMappings'
177
- Resource:
178
- - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:event-source-mapping:*'
46
+ # Access key for the deployment user
47
+ FriggDeploymentAccessKey:
48
+ Type: AWS::IAM::AccessKey
49
+ Properties:
50
+ UserName: !Ref FriggDeploymentUser
179
51
 
180
- # IAM role permissions
181
- - Sid: 'IAMRolesForFriggLambda'
182
- Effect: Allow
183
- Action:
184
- - 'iam:CreateRole'
185
- - 'iam:DeleteRole'
186
- - 'iam:GetRole'
187
- - 'iam:PassRole'
188
- - 'iam:PutRolePolicy'
189
- - 'iam:DeleteRolePolicy'
190
- - 'iam:GetRolePolicy'
191
- - 'iam:AttachRolePolicy'
192
- - 'iam:DetachRolePolicy'
193
- - 'iam:TagRole'
194
- - 'iam:UntagRole'
195
- Resource:
196
- - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*'
197
- - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*LambdaRole*'
52
+ # Discovery-time permissions (required for build process)
53
+ FriggDiscoveryPolicy:
54
+ Type: AWS::IAM::ManagedPolicy
55
+ Properties:
56
+ ManagedPolicyName: 'FriggDiscoveryPolicy'
57
+ Description: 'Permissions for AWS resource discovery during Frigg build process'
58
+ PolicyDocument:
59
+ Version: '2012-10-17'
60
+ Statement:
61
+ - Sid: 'AWSDiscoveryPermissions'
62
+ Effect: Allow
63
+ Action:
64
+ - 'sts:GetCallerIdentity'
65
+ - 'ec2:DescribeVpcs'
66
+ - 'ec2:DescribeSubnets'
67
+ - 'ec2:DescribeSecurityGroups'
68
+ - 'ec2:DescribeRouteTables'
69
+ - 'kms:ListKeys'
70
+ - 'kms:DescribeKey'
71
+ Resource: '*'
198
72
 
199
- # IAM policy permissions
200
- - Sid: 'IAMPolicyVersionPermissions'
201
- Effect: Allow
202
- Action:
203
- - 'iam:ListPolicyVersions'
204
- Resource:
205
- - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/*'
73
+ # Core deployment permissions
74
+ FriggCoreDeploymentPolicy:
75
+ Type: AWS::IAM::ManagedPolicy
76
+ Properties:
77
+ ManagedPolicyName: 'FriggCoreDeploymentPolicy'
78
+ Description: 'Core permissions for deploying Frigg applications'
79
+ PolicyDocument:
80
+ Version: '2012-10-17'
81
+ Statement:
82
+ # CloudFormation permissions
83
+ - Sid: 'CloudFormationFriggStacks'
84
+ Effect: Allow
85
+ Action:
86
+ - 'cloudformation:CreateStack'
87
+ - 'cloudformation:UpdateStack'
88
+ - 'cloudformation:DeleteStack'
89
+ - 'cloudformation:DescribeStacks'
90
+ - 'cloudformation:DescribeStackEvents'
91
+ - 'cloudformation:DescribeStackResources'
92
+ - 'cloudformation:DescribeStackResource'
93
+ - 'cloudformation:ListStackResources'
94
+ - 'cloudformation:GetTemplate'
95
+ - 'cloudformation:DescribeChangeSet'
96
+ - 'cloudformation:CreateChangeSet'
97
+ - 'cloudformation:DeleteChangeSet'
98
+ - 'cloudformation:ExecuteChangeSet'
99
+ Resource:
100
+ - !Sub 'arn:aws:cloudformation:*:${AWS::AccountId}:stack/*frigg*/*'
101
+
102
+ # ValidateTemplate needs to be allowed on all resources
103
+ - Sid: 'CloudFormationValidateTemplate'
104
+ Effect: Allow
105
+ Action:
106
+ - 'cloudformation:ValidateTemplate'
107
+ Resource: '*'
108
+
109
+ # S3 deployment bucket permissions
110
+ - Sid: 'S3DeploymentBucket'
111
+ Effect: Allow
112
+ Action:
113
+ - 's3:CreateBucket'
114
+ - 's3:PutObject'
115
+ - 's3:GetObject'
116
+ - 's3:DeleteObject'
117
+ - 's3:PutBucketPolicy'
118
+ - 's3:PutBucketVersioning'
119
+ - 's3:PutBucketPublicAccessBlock'
120
+ - 's3:GetBucketLocation'
121
+ - 's3:ListBucket'
122
+ - 's3:PutBucketTagging'
123
+ - 's3:GetBucketTagging'
124
+ Resource:
125
+ - 'arn:aws:s3:::*serverless*'
126
+ - 'arn:aws:s3:::*serverless*/*'
127
+
128
+ # Lambda function permissions
129
+ - Sid: 'LambdaFriggFunctions'
130
+ Effect: Allow
131
+ Action:
132
+ - 'lambda:CreateFunction'
133
+ - 'lambda:UpdateFunctionCode'
134
+ - 'lambda:UpdateFunctionConfiguration'
135
+ - 'lambda:DeleteFunction'
136
+ - 'lambda:GetFunction'
137
+ - 'lambda:ListFunctions'
138
+ - 'lambda:PublishVersion'
139
+ - 'lambda:CreateAlias'
140
+ - 'lambda:UpdateAlias'
141
+ - 'lambda:DeleteAlias'
142
+ - 'lambda:GetAlias'
143
+ - 'lambda:AddPermission'
144
+ - 'lambda:RemovePermission'
145
+ - 'lambda:GetPolicy'
146
+ - 'lambda:PutProvisionedConcurrencyConfig'
147
+ - 'lambda:DeleteProvisionedConcurrencyConfig'
148
+ - 'lambda:PutConcurrency'
149
+ - 'lambda:DeleteConcurrency'
150
+ - 'lambda:TagResource'
151
+ - 'lambda:UntagResource'
152
+ - 'lambda:ListVersionsByFunction'
153
+ Resource:
154
+ - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:function:*frigg*'
155
+
156
+ # Lambda EventSourceMapping permissions
157
+ - Sid: 'FriggLambdaEventSourceMapping'
158
+ Effect: Allow
159
+ Action:
160
+ - 'lambda:CreateEventSourceMapping'
161
+ - 'lambda:DeleteEventSourceMapping'
162
+ - 'lambda:GetEventSourceMapping'
163
+ - 'lambda:UpdateEventSourceMapping'
164
+ - 'lambda:ListEventSourceMappings'
165
+ Resource:
166
+ - !Sub 'arn:aws:lambda:*:${AWS::AccountId}:event-source-mapping:*'
167
+
168
+ # IAM role permissions
169
+ - Sid: 'IAMRolesForFriggLambda'
170
+ Effect: Allow
171
+ Action:
172
+ - 'iam:CreateRole'
173
+ - 'iam:DeleteRole'
174
+ - 'iam:GetRole'
175
+ - 'iam:PassRole'
176
+ - 'iam:PutRolePolicy'
177
+ - 'iam:DeleteRolePolicy'
178
+ - 'iam:GetRolePolicy'
179
+ - 'iam:AttachRolePolicy'
180
+ - 'iam:DetachRolePolicy'
181
+ - 'iam:TagRole'
182
+ - 'iam:UntagRole'
183
+ Resource:
184
+ - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*'
185
+ - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*frigg*LambdaRole*'
186
+
187
+ # IAM policy permissions
188
+ - Sid: 'IAMPolicyVersionPermissions'
189
+ Effect: Allow
190
+ Action:
191
+ - 'iam:ListPolicyVersions'
192
+ Resource:
193
+ - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/*'
194
+
195
+ # SQS permissions
196
+ - Sid: 'FriggMessagingServices'
197
+ Effect: Allow
198
+ Action:
199
+ - 'sqs:CreateQueue'
200
+ - 'sqs:DeleteQueue'
201
+ - 'sqs:GetQueueAttributes'
202
+ - 'sqs:SetQueueAttributes'
203
+ - 'sqs:GetQueueUrl'
204
+ - 'sqs:TagQueue'
205
+ - 'sqs:UntagQueue'
206
+ Resource:
207
+ - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*frigg*'
208
+ # Case-sensitive glob: the app-level FIFO queue is named
209
+ # "...-FriggUserActionQueue.fifo" which "*frigg*" would not match.
210
+ - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*Frigg*'
211
+ - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:internal-error-queue-*'
212
+
213
+ # SNS permissions
214
+ - Sid: 'FriggSNSTopics'
215
+ Effect: Allow
216
+ Action:
217
+ - 'sns:CreateTopic'
218
+ - 'sns:DeleteTopic'
219
+ - 'sns:GetTopicAttributes'
220
+ - 'sns:SetTopicAttributes'
221
+ - 'sns:Subscribe'
222
+ - 'sns:Unsubscribe'
223
+ - 'sns:ListSubscriptionsByTopic'
224
+ - 'sns:TagResource'
225
+ - 'sns:UntagResource'
226
+ Resource:
227
+ - !Sub 'arn:aws:sns:*:${AWS::AccountId}:*frigg*'
228
+
229
+ # CloudWatch and Logs permissions
230
+ - Sid: 'FriggMonitoringAndLogs'
231
+ Effect: Allow
232
+ Action:
233
+ - 'cloudwatch:PutMetricAlarm'
234
+ - 'cloudwatch:DeleteAlarms'
235
+ - 'cloudwatch:DescribeAlarms'
236
+ - 'logs:CreateLogGroup'
237
+ - 'logs:CreateLogStream'
238
+ - 'logs:DeleteLogGroup'
239
+ - 'logs:DescribeLogGroups'
240
+ - 'logs:DescribeLogStreams'
241
+ - 'logs:FilterLogEvents'
242
+ - 'logs:PutLogEvents'
243
+ - 'logs:PutRetentionPolicy'
244
+ Resource:
245
+ - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*'
246
+ - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*:*'
247
+ - !Sub 'arn:aws:cloudwatch:*:${AWS::AccountId}:alarm:*frigg*'
248
+
249
+ # API Gateway permissions
250
+ - Sid: 'FriggAPIGateway'
251
+ Effect: Allow
252
+ Action:
253
+ - 'apigateway:POST'
254
+ - 'apigateway:PUT'
255
+ - 'apigateway:DELETE'
256
+ - 'apigateway:GET'
257
+ - 'apigateway:PATCH'
258
+ Resource:
259
+ - 'arn:aws:apigateway:*::/restapis'
260
+ - 'arn:aws:apigateway:*::/restapis/*'
261
+ - 'arn:aws:apigateway:*::/domainnames'
262
+ - 'arn:aws:apigateway:*::/domainnames/*'
263
+
264
+ # API Gateway v2 permissions
265
+ - Sid: 'FriggAPIGatewayV2'
266
+ Effect: Allow
267
+ Action:
268
+ - 'apigateway:GET'
269
+ - 'apigateway:DELETE'
270
+ - 'apigateway:PATCH'
271
+ - 'apigateway:POST'
272
+ - 'apigateway:PUT'
273
+ Resource:
274
+ - 'arn:aws:apigateway:*::/apis'
275
+ - 'arn:aws:apigateway:*::/apis/*'
276
+ - 'arn:aws:apigateway:*::/apis/*/stages'
277
+ - 'arn:aws:apigateway:*::/apis/*/stages/*'
278
+ - 'arn:aws:apigateway:*::/apis/*/mappings'
279
+ - 'arn:aws:apigateway:*::/apis/*/mappings/*'
280
+ - 'arn:aws:apigateway:*::/domainnames'
281
+ - 'arn:aws:apigateway:*::/domainnames/*'
282
+ - 'arn:aws:apigateway:*::/domainnames/*/apimappings'
206
283
 
207
- # SQS permissions
208
- - Sid: 'FriggMessagingServices'
209
- Effect: Allow
210
- Action:
211
- - 'sqs:CreateQueue'
212
- - 'sqs:DeleteQueue'
213
- - 'sqs:GetQueueAttributes'
214
- - 'sqs:SetQueueAttributes'
215
- - 'sqs:GetQueueUrl'
216
- - 'sqs:TagQueue'
217
- - 'sqs:UntagQueue'
218
- Resource:
219
- - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*frigg*'
220
- # Case-sensitive glob: the app-level FIFO queue is named
221
- # "...-FriggUserActionQueue.fifo" which "*frigg*" would not match.
222
- - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:*Frigg*'
223
- - !Sub 'arn:aws:sqs:*:${AWS::AccountId}:internal-error-queue-*'
284
+ # VPC-specific permissions
285
+ FriggVPCPolicy:
286
+ Type: AWS::IAM::ManagedPolicy
287
+ Condition: CreateVPCPermissions
288
+ Properties:
289
+ ManagedPolicyName: 'FriggVPCPolicy'
290
+ Description: 'VPC-related permissions for Frigg applications'
291
+ PolicyDocument:
292
+ Version: '2012-10-17'
293
+ Statement:
294
+ - Sid: 'FriggVPCEndpointManagement'
295
+ Effect: Allow
296
+ Action:
297
+ - 'ec2:CreateVpcEndpoint'
298
+ - 'ec2:DeleteVpcEndpoints'
299
+ - 'ec2:DescribeVpcEndpoints'
300
+ - 'ec2:ModifyVpcEndpoint'
301
+ - 'ec2:CreateNatGateway'
302
+ - 'ec2:DeleteNatGateway'
303
+ - 'ec2:DescribeNatGateways'
304
+ - 'ec2:AllocateAddress'
305
+ - 'ec2:ReleaseAddress'
306
+ - 'ec2:DescribeAddresses'
307
+ - 'ec2:CreateRouteTable'
308
+ - 'ec2:DeleteRouteTable'
309
+ - 'ec2:DescribeRouteTables'
310
+ - 'ec2:CreateRoute'
311
+ - 'ec2:DeleteRoute'
312
+ - 'ec2:AssociateRouteTable'
313
+ - 'ec2:DisassociateRouteTable'
314
+ - 'ec2:CreateSecurityGroup'
315
+ - 'ec2:DeleteSecurityGroup'
316
+ - 'ec2:AuthorizeSecurityGroupEgress'
317
+ - 'ec2:AuthorizeSecurityGroupIngress'
318
+ - 'ec2:RevokeSecurityGroupEgress'
319
+ - 'ec2:RevokeSecurityGroupIngress'
320
+ - 'ec2:CreateTags'
321
+ - 'ec2:DeleteTags'
322
+ - 'ec2:DescribeTags'
323
+ - 'ec2:DetachInternetGateway'
324
+ - 'ec2:DeleteSubnet'
325
+ Resource: '*'
224
326
 
225
- # SNS permissions
226
- - Sid: 'FriggSNSTopics'
227
- Effect: Allow
228
- Action:
229
- - 'sns:CreateTopic'
230
- - 'sns:DeleteTopic'
231
- - 'sns:GetTopicAttributes'
232
- - 'sns:SetTopicAttributes'
233
- - 'sns:Subscribe'
234
- - 'sns:Unsubscribe'
235
- - 'sns:ListSubscriptionsByTopic'
236
- - 'sns:TagResource'
237
- - 'sns:UntagResource'
238
- Resource:
239
- - !Sub 'arn:aws:sns:*:${AWS::AccountId}:*frigg*'
327
+ # KMS permissions
328
+ FriggKMSPolicy:
329
+ Type: AWS::IAM::ManagedPolicy
330
+ Condition: CreateKMSPermissions
331
+ Properties:
332
+ ManagedPolicyName: 'FriggKMSPolicy'
333
+ Description: 'KMS encryption permissions for Frigg applications'
334
+ PolicyDocument:
335
+ Version: '2012-10-17'
336
+ Statement:
337
+ - Sid: 'FriggKMSEncryptionRuntime'
338
+ Effect: Allow
339
+ Action:
340
+ - 'kms:GenerateDataKey'
341
+ - 'kms:Decrypt'
342
+ Resource:
343
+ - !Sub 'arn:aws:kms:*:${AWS::AccountId}:key/*'
344
+ Condition:
345
+ StringEquals:
346
+ 'kms:ViaService':
347
+ - 'lambda.*.amazonaws.com'
348
+ - 's3.*.amazonaws.com'
240
349
 
241
- # CloudWatch and Logs permissions
242
- - Sid: 'FriggMonitoringAndLogs'
243
- Effect: Allow
244
- Action:
245
- - 'cloudwatch:PutMetricAlarm'
246
- - 'cloudwatch:DeleteAlarms'
247
- - 'cloudwatch:DescribeAlarms'
248
- - 'logs:CreateLogGroup'
249
- - 'logs:CreateLogStream'
250
- - 'logs:DeleteLogGroup'
251
- - 'logs:DescribeLogGroups'
252
- - 'logs:DescribeLogStreams'
253
- - 'logs:FilterLogEvents'
254
- - 'logs:PutLogEvents'
255
- - 'logs:PutRetentionPolicy'
256
- Resource:
257
- - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*'
258
- - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*frigg*:*'
259
- - !Sub 'arn:aws:cloudwatch:*:${AWS::AccountId}:alarm:*frigg*'
350
+ # SSM Parameter Store permissions
351
+ FriggSSMPolicy:
352
+ Type: AWS::IAM::ManagedPolicy
353
+ Condition: CreateSSMPermissions
354
+ Properties:
355
+ ManagedPolicyName: 'FriggSSMPolicy'
356
+ Description: 'SSM Parameter Store permissions for Frigg applications'
357
+ PolicyDocument:
358
+ Version: '2012-10-17'
359
+ Statement:
360
+ - Sid: 'FriggSSMParameterAccess'
361
+ Effect: Allow
362
+ Action:
363
+ - 'ssm:GetParameter'
364
+ - 'ssm:GetParameters'
365
+ - 'ssm:GetParametersByPath'
366
+ Resource:
367
+ - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*'
368
+ - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*/*'
260
369
 
261
- # API Gateway permissions
262
- - Sid: 'FriggAPIGateway'
263
- Effect: Allow
264
- Action:
265
- - 'apigateway:POST'
266
- - 'apigateway:PUT'
267
- - 'apigateway:DELETE'
268
- - 'apigateway:GET'
269
- - 'apigateway:PATCH'
270
- Resource:
271
- - 'arn:aws:apigateway:*::/restapis'
272
- - 'arn:aws:apigateway:*::/restapis/*'
273
- - 'arn:aws:apigateway:*::/domainnames'
274
- - 'arn:aws:apigateway:*::/domainnames/*'
275
-
276
- # API Gateway v2 permissions
277
- - Sid: 'FriggAPIGatewayV2'
278
- Effect: Allow
279
- Action:
280
- - 'apigateway:GET'
281
- - 'apigateway:DELETE'
282
- - 'apigateway:PATCH'
283
- - 'apigateway:POST'
284
- - 'apigateway:PUT'
285
- Resource:
286
- - 'arn:aws:apigateway:*::/apis'
287
- - 'arn:aws:apigateway:*::/apis/*'
288
- - 'arn:aws:apigateway:*::/apis/*/stages'
289
- - 'arn:aws:apigateway:*::/apis/*/stages/*'
290
- - 'arn:aws:apigateway:*::/apis/*/mappings'
291
- - 'arn:aws:apigateway:*::/apis/*/mappings/*'
292
- - 'arn:aws:apigateway:*::/domainnames'
293
- - 'arn:aws:apigateway:*::/domainnames/*'
294
- - 'arn:aws:apigateway:*::/domainnames/*/apimappings'
295
-
296
- # VPC-specific permissions
297
- FriggVPCPolicy:
298
- Type: AWS::IAM::ManagedPolicy
299
- Condition: CreateVPCPermissions
300
- Properties:
301
- ManagedPolicyName: 'FriggVPCPolicy'
302
- Description: 'VPC-related permissions for Frigg applications'
303
- PolicyDocument:
304
- Version: '2012-10-17'
305
- Statement:
306
- - Sid: 'FriggVPCEndpointManagement'
307
- Effect: Allow
308
- Action:
309
- - 'ec2:CreateVpcEndpoint'
310
- - 'ec2:DeleteVpcEndpoints'
311
- - 'ec2:DescribeVpcEndpoints'
312
- - 'ec2:ModifyVpcEndpoint'
313
- - 'ec2:CreateNatGateway'
314
- - 'ec2:DeleteNatGateway'
315
- - 'ec2:DescribeNatGateways'
316
- - 'ec2:AllocateAddress'
317
- - 'ec2:ReleaseAddress'
318
- - 'ec2:DescribeAddresses'
319
- - 'ec2:CreateRouteTable'
320
- - 'ec2:DeleteRouteTable'
321
- - 'ec2:DescribeRouteTables'
322
- - 'ec2:CreateRoute'
323
- - 'ec2:DeleteRoute'
324
- - 'ec2:AssociateRouteTable'
325
- - 'ec2:DisassociateRouteTable'
326
- - 'ec2:CreateSecurityGroup'
327
- - 'ec2:DeleteSecurityGroup'
328
- - 'ec2:AuthorizeSecurityGroupEgress'
329
- - 'ec2:AuthorizeSecurityGroupIngress'
330
- - 'ec2:RevokeSecurityGroupEgress'
331
- - 'ec2:RevokeSecurityGroupIngress'
332
- - 'ec2:CreateTags'
333
- - 'ec2:DeleteTags'
334
- - 'ec2:DescribeTags'
335
- - 'ec2:DetachInternetGateway'
336
- - 'ec2:DeleteSubnet'
337
- Resource: '*'
338
-
339
- # KMS permissions
340
- FriggKMSPolicy:
341
- Type: AWS::IAM::ManagedPolicy
342
- Condition: CreateKMSPermissions
343
- Properties:
344
- ManagedPolicyName: 'FriggKMSPolicy'
345
- Description: 'KMS encryption permissions for Frigg applications'
346
- PolicyDocument:
347
- Version: '2012-10-17'
348
- Statement:
349
- - Sid: 'FriggKMSEncryptionRuntime'
350
- Effect: Allow
351
- Action:
352
- - 'kms:GenerateDataKey'
353
- - 'kms:Decrypt'
354
- Resource:
355
- - !Sub 'arn:aws:kms:*:${AWS::AccountId}:key/*'
356
- Condition:
357
- StringEquals:
358
- 'kms:ViaService':
359
- - 'lambda.*.amazonaws.com'
360
- - 's3.*.amazonaws.com'
361
-
362
- # SSM Parameter Store permissions
363
- FriggSSMPolicy:
364
- Type: AWS::IAM::ManagedPolicy
365
- Condition: CreateSSMPermissions
366
- Properties:
367
- ManagedPolicyName: 'FriggSSMPolicy'
368
- Description: 'SSM Parameter Store permissions for Frigg applications'
369
- PolicyDocument:
370
- Version: '2012-10-17'
371
- Statement:
372
- - Sid: 'FriggSSMParameterAccess'
373
- Effect: Allow
374
- Action:
375
- - 'ssm:GetParameter'
376
- - 'ssm:GetParameters'
377
- - 'ssm:GetParametersByPath'
378
- Resource:
379
- - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*'
380
- - !Sub 'arn:aws:ssm:*:${AWS::AccountId}:parameter/*frigg*/*'
381
-
382
- # Store access key in Secrets Manager
383
- FriggDeploymentCredentials:
384
- Type: AWS::SecretsManager::Secret
385
- Properties:
386
- Name: 'frigg-deployment-credentials'
387
- Description: 'Access credentials for Frigg deployment user'
388
- SecretString: !Sub |
389
- {
390
- "AccessKeyId": "${FriggDeploymentAccessKey}",
391
- "SecretAccessKey": "${FriggDeploymentAccessKey.SecretAccessKey}"
392
- }
370
+ # Store access key in Secrets Manager
371
+ FriggDeploymentCredentials:
372
+ Type: AWS::SecretsManager::Secret
373
+ Properties:
374
+ Name: 'frigg-deployment-credentials'
375
+ Description: 'Access credentials for Frigg deployment user'
376
+ SecretString: !Sub |
377
+ {
378
+ "AccessKeyId": "${FriggDeploymentAccessKey}",
379
+ "SecretAccessKey": "${FriggDeploymentAccessKey.SecretAccessKey}"
380
+ }
393
381
 
394
382
  Outputs:
395
- DeploymentUserArn:
396
- Description: 'ARN of the Frigg deployment user'
397
- Value: !GetAtt FriggDeploymentUser.Arn
398
- Export:
399
- Name: !Sub '${AWS::StackName}-UserArn'
400
-
401
- AccessKeyId:
402
- Description: 'Access Key ID for the deployment user'
403
- Value: !Ref FriggDeploymentAccessKey
404
- Export:
405
- Name: !Sub '${AWS::StackName}-AccessKeyId'
406
-
407
- SecretAccessKeyCommand:
408
- Description: 'Command to retrieve the secret access key'
409
- Value: !Sub |
410
- aws secretsmanager get-secret-value --secret-id frigg-deployment-credentials --query SecretString --output text | jq -r .SecretAccessKey
411
-
412
- CredentialsSecretArn:
413
- Description: 'ARN of the secret containing deployment credentials'
414
- Value: !Ref FriggDeploymentCredentials
415
- Export:
416
- Name: !Sub '${AWS::StackName}-CredentialsSecretArn'
383
+ DeploymentUserArn:
384
+ Description: 'ARN of the Frigg deployment user'
385
+ Value: !GetAtt FriggDeploymentUser.Arn
386
+ Export:
387
+ Name: !Sub '${AWS::StackName}-UserArn'
388
+
389
+ AccessKeyId:
390
+ Description: 'Access Key ID for the deployment user'
391
+ Value: !Ref FriggDeploymentAccessKey
392
+ Export:
393
+ Name: !Sub '${AWS::StackName}-AccessKeyId'
394
+
395
+ SecretAccessKeyCommand:
396
+ Description: 'Command to retrieve the secret access key'
397
+ Value: !Sub |
398
+ aws secretsmanager get-secret-value --secret-id frigg-deployment-credentials --query SecretString --output text | jq -r .SecretAccessKey
399
+
400
+ CredentialsSecretArn:
401
+ Description: 'ARN of the secret containing deployment credentials'
402
+ Value: !Ref FriggDeploymentCredentials
403
+ Export:
404
+ Name: !Sub '${AWS::StackName}-CredentialsSecretArn'