cloudmason2 1.7.0 → 1.7.999
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/commands/new_app.js +38 -0
- package/package.json +1 -1
package/commands/new_app.js
CHANGED
|
@@ -201,6 +201,44 @@ async function ensureGithubRole(repo, bucket, appPrefix, appName, productId){
|
|
|
201
201
|
Action: "cloudformation:GetTemplateSummary",
|
|
202
202
|
Resource: "*"
|
|
203
203
|
},
|
|
204
|
+
{
|
|
205
|
+
Sid: "LaunchStackServices",
|
|
206
|
+
Effect: "Allow",
|
|
207
|
+
// CloudFormation provisions stack resources with the caller's
|
|
208
|
+
// credentials. Certs, DNS records, and user pools get
|
|
209
|
+
// unpredictable ARNs, so these cannot be resource-scoped
|
|
210
|
+
Action: ["acm:*", "route53:*", "cognito-idp:*"],
|
|
211
|
+
Resource: "*"
|
|
212
|
+
},
|
|
213
|
+
{
|
|
214
|
+
Sid: "AppStackIam",
|
|
215
|
+
Effect: "Allow",
|
|
216
|
+
Action: [
|
|
217
|
+
"iam:CreateRole", "iam:DeleteRole", "iam:GetRole", "iam:UpdateRole", "iam:TagRole", "iam:UntagRole",
|
|
218
|
+
"iam:PutRolePolicy", "iam:DeleteRolePolicy", "iam:GetRolePolicy", "iam:ListRolePolicies",
|
|
219
|
+
"iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:ListAttachedRolePolicies", "iam:PassRole",
|
|
220
|
+
"iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:GetInstanceProfile",
|
|
221
|
+
"iam:AddRoleToInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:TagInstanceProfile"
|
|
222
|
+
],
|
|
223
|
+
// CFN-generated role/profile names start with the stack name,
|
|
224
|
+
// and launch names every stack <app>-<title>
|
|
225
|
+
Resource: [
|
|
226
|
+
`arn:aws:iam::${accountId}:role/${appName}-*`,
|
|
227
|
+
`arn:aws:iam::${accountId}:instance-profile/${appName}-*`
|
|
228
|
+
]
|
|
229
|
+
},
|
|
230
|
+
{
|
|
231
|
+
Sid: "AppStackBuckets",
|
|
232
|
+
Effect: "Allow",
|
|
233
|
+
Action: "s3:*",
|
|
234
|
+
Resource: [`arn:aws:s3:::${appName}-*`, `arn:aws:s3:::${appName}-*/*`]
|
|
235
|
+
},
|
|
236
|
+
{
|
|
237
|
+
Sid: "AppStackTables",
|
|
238
|
+
Effect: "Allow",
|
|
239
|
+
Action: "dynamodb:*",
|
|
240
|
+
Resource: `arn:aws:dynamodb:*:${accountId}:table/${appName}-*`
|
|
241
|
+
},
|
|
204
242
|
{
|
|
205
243
|
Sid: "ReadRoleParam",
|
|
206
244
|
Effect: "Allow",
|