Given the following definition ```const table = table stack Serverless Stack #help

Given the following definition ```const table = /...

Michael Wolfenden

04/05/2021, 10:23 PM

Given the following definition

Copy code

const table = /* table stack */

const api = new sst.Api(this, 'Api', {
  routes: {
    'GET /restaurants': {
      handler: `src/functions/get-restaurants.main`,
      environment: {
        RESTAURANTS_TABLE_NAME: table.dynamodbTable.tableName,
      },
    },
  },
})

I want to give that particular route only scan access to dynamodb. Is the code below correct or do I need to use to specify a complete IAM policy

Copy code

api.attachPermissionsToRoute('GET /restaurants', [table, 'dynamodb:Scan'])

Also is it possible to specify permissions in-line with the route definition?

Frank

04/05/2021, 11:16 PM

You are actually granting two permissions to the Lambda function: • table - this grants

dynamodb:*

to this table • dynamodb:Scan - this grants

dynamodb:Scan

to all tables

Copy code

api.attachPermissionsToRoute('GET /restaurants', [table, 'dynamodb:Scan'])

Frank

04/05/2021, 11:17 PM

You can just do this to grant

dynamodb:Scan

to all tables:

Copy code

api.attachPermissionsToRoute('GET /restaurants', ['dynamodb:Scan'])

Frank

04/05/2021, 11:18 PM

Or you can do this to grant

dynamodb:Scan

to just a specific table:

Copy code

api.attachPermissionsToRoute('GET /restaurants', [
  new iam.PolicyStatement({
    actions: ["dynamodb:Scan"],
    effect: iam.Effect.ALLOW,
    resources: [ table.tableArn ],
  }),
])

Michael Wolfenden

04/05/2021, 11:19 PM

Is it possible to specify this inline with the route definition?

Frank

04/05/2021, 11:24 PM

good point. I was actually just thinking about this the other day.

Frank

04/05/2021, 11:25 PM

Do u think you are going to have custom permissions for each route?

Michael Wolfenden

04/05/2021, 11:25 PM

Yep .. I'm trying to follow the principle of least privilege

Frank

04/05/2021, 11:27 PM

Sounds good. Lemme give it some thoughts. Most likely I will put it into the next release or the one after.

Michael Wolfenden

04/05/2021, 11:28 PM

Appreciate the help

Frank

04/14/2021, 10:16 AM

Hey @Michael Wolfenden You can now set route

permissions

inline in v0.10.11. You can also configure

permission

inside

defaultFunctionProps

. And the default permissions will be merged with the route permissions if both are configured for a given route. Here are a couple of examples - https://docs.serverless-stack.com/constructs/Api#specifying-function-props-for-all-the-routes

Michael Wolfenden

04/14/2021, 10:18 AM

@Frank you've made me a very happy man

Open in Slack

Previous Next