@jaypie/constructs 1.1.47 → 1.1.49

package/dist/esm/index.js

@@ -14,7 +14,7 @@ import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as s3n from 'aws-cdk-lib/aws-s3-notifications';
 import * as sqs from 'aws-cdk-lib/aws-sqs';
 import * as lambdaEventSources from 'aws-cdk-lib/aws-lambda-event-sources';
-import { ServicePrincipal, Role, FederatedPrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
+import { ServicePrincipal, ManagedPolicy, Role, FederatedPrincipal, PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam';
 import { LogGroup, RetentionDays, FilterPattern } from 'aws-cdk-lib/aws-logs';
 import * as sso from 'aws-cdk-lib/aws-sso';
 import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
@@ -44,7 +44,7 @@ function addDatadogLayers(lambdaFunction, options = {}) {
     Object.entries(datadogEnvVars).forEach(([key, value]) => {
         lambdaFunction.addEnvironment(key, value);
     });
-    const datadogApiKeySecret = secretsmanager.Secret.fromSecretNameV2(lambdaFunction, "DatadogApiKey", resolvedDatadogApiKeyArn);
+    const datadogApiKeySecret = secretsmanager.Secret.fromSecretCompleteArn(lambdaFunction, "DatadogApiKey", resolvedDatadogApiKeyArn);
     const datadogLambda = new DatadogLambda(lambdaFunction, "DatadogLambda", {
         apiKeySecret: datadogApiKeySecret, // apiKeySecret auto-grants secret access to the added lambdas
         nodeLayerVersion: CDK$2.DATADOG.LAYER.NODE,
@@ -1357,6 +1357,7 @@ class JaypieSsoGroups extends Construct {
                         "budgets:*",
                         "ce:*",
                         "cost-optimization-hub:*",
+                        "cur:*",
                     ],
                     Resource: "*",
                 },
@@ -1386,14 +1387,52 @@ class JaypieSsoGroups extends Construct {
                 {
                     Effect: "Allow",
                     Action: [
+                        "aws-portal:ViewUsage",
                         "aws-portal:ViewBilling",
-                        "aws-portal:ViewAccount",
-                        "budgets:ViewBudget",
-                        "cloudwatch:PutDashboard",
-                        "cloudwatch:PutMetricData",
-                        "s3:PutObject",
-                        "s3:GetObject",
-                        "s3:ListBucket",
+                        "budgets:Describe*",
+                        "budgets:View*",
+                        "ce:Get*",
+                        "ce:List*",
+                        "cloudformation:Describe*",
+                        "cloudformation:Get*",
+                        "cloudformation:List*",
+                        "cloudwatch:BatchGet*",
+                        "cloudwatch:Get*",
+                        "cloudwatch:List*",
+                        "cost-optimization-hub:Get*",
+                        "cost-optimization-hub:List*",
+                        "ec2:Describe*",
+                        "ec2:Get*",
+                        "ec2:List*",
+                        "ec2:Search*",
+                        "iam:Get*",
+                        "iam:List*",
+                        "iam:PassRole",
+                        "lambda:Get*",
+                        "lambda:List*",
+                        "logs:Describe*",
+                        "logs:Get*",
+                        "logs:List*",
+                        "pipes:Describe*",
+                        "pipes:List*",
+                        "s3:Get*",
+                        "s3:List*",
+                        "secretsmanager:GetRandomPassword",
+                        "secretsmanager:GetResourcePolicy",
+                        "secretsmanager:List*",
+                        "securityhub:Describe*",
+                        "securityhub:Get*",
+                        "securityhub:List*",
+                        "servicecatalog:Describe*",
+                        "sns:Get*",
+                        "sns:List*",
+                        "sqs:Get*",
+                        "sqs:List*",
+                        "states:Describe*",
+                        "states:Get*",
+                        "states:List*",
+                        "tag:*",
+                        "xray:*",
                     ],
                     Resource: "*",
                 },
@@ -1406,7 +1445,12 @@ class JaypieSsoGroups extends Construct {
             name: PermissionSetType.ANALYST,
             description: "Read-only access with billing visibility and limited write access",
             sessionDuration: Duration.hours(4).toIsoString(),
-            managedPolicies: ["arn:aws:iam::aws:policy/ReadOnlyAccess"],
+            managedPolicies: [
+                ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                    .managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                    .managedPolicyArn,
+            ],
             inlinePolicy: mergedPolicy,
         });
         Tags.of(permissionSet).add(CDK$2.TAG.SERVICE, CDK$2.SERVICE.SSO);
@@ -1423,18 +1467,27 @@ class JaypieSsoGroups extends Construct {
                 {
                     Effect: "Allow",
                     Action: [
+                        "budgets:*",
+                        "ce:*",
+                        "cloudformation:*",
                         "cloudwatch:*",
-                        "logs:*",
+                        "cost-optimization-hub:*",
+                        "ec2:*",
+                        "iam:Get*",
+                        "iam:List*",
+                        "iam:PassRole",
                         "lambda:*",
-                        "apigateway:*",
-                        "dynamodb:*",
+                        "logs:*",
+                        "pipes:*",
                         "s3:*",
+                        "secretsmanager:*",
+                        "securityhub:*",
+                        "servicecatalog:*",
                         "sns:*",
                         "sqs:*",
-                        "events:*",
-                        "ecr:*",
-                        "ecs:*",
-                        "codebuild:*",
+                        "states:*",
+                        "tag:*",
+                        "xray:*",
                     ],
                     Resource: "*",
                 },
@@ -1459,7 +1512,11 @@ class JaypieSsoGroups extends Construct {
             description: "System administrator access with expanded write permissions",
             sessionDuration: Duration.hours(8).toIsoString(),
             managedPolicies: [
-                "arn:aws:iam::aws:policy/job-function/SystemAdministrator",
+                ManagedPolicy.fromAwsManagedPolicyName("AmazonQDeveloperAccess")
+                    .managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("ReadOnlyAccess")
+                    .managedPolicyArn,
+                ManagedPolicy.fromAwsManagedPolicyName("job-function/SystemAdministrator").managedPolicyArn,
             ],
             inlinePolicy: mergedPolicy,
         });