Does the name i e type=string option in <https docs serverle Serverless Stack #help

Does the name (i.e. type=string) option in <https:...

Tom Hoad

03/04/2021, 9:56 AM

Does the name (i.e. type=string) option in https://docs.serverless-stack.com/util/Permissions#permission just give wildcard permissions to that resource (e.g.

s3

===

s3:*

)? And if so, to add more granular permissions per action, I need to add a full policy statement - is this correct?

Frank

03/04/2021, 10:33 AM

Hi @Tom Hoad, that’s correct. You can also pass in an

s3.Bucket

construct, this will grant

s3:*

to the bucket’s ARN.

Copy code

attachPermissions([s3]);

Or, pass in a grant function (ie. https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-dynamodb.Table.html#grantwbrreadwbrdatagrantee)

Copy code

attachPermissions([ [s3, "grantReadData"] ]);

Frank

03/04/2021, 10:34 AM

This page lists the different ways https://docs.serverless-stack.com/util/Permissions

Tom Hoad

03/04/2021, 10:49 AM

Awesome, busy migrating my (toy) app from the original SST to the new SST, I like how some of the complexity/verbosity is now rolled into the framework (e.g. the role stuff for Cognito)

Frank

03/04/2021, 10:53 AM

Nice! Yup dealing with IAM stuff sucks.

Tom Hoad

03/04/2021, 11:01 AM

And as there is no built-in S3 SST construct (yet?) I can just use the CDK construct directly?

Tom Hoad

03/04/2021, 12:07 PM

Hmm, I'm instantiating a new bucket using the S3 construct:

Copy code

const bucket = new s3.Bucket(this, "Uploads", { ...

Then attempting to attach permissions for

bucket

to the roles:

Copy code

auth.attachPermissionsForAuthUsers([api, [bucket, "grantReadWriteData"]]);
auth.attachPermissionsForUnauthUsers([[bucket, "grantReadData"]]);

But I get an error on deployment:

Copy code

TypeError: construct[methodName] is not a function

Tom Hoad

03/04/2021, 12:11 PM

Doh, wrong grant function!

Frank

03/04/2021, 5:22 PM

Yup, passing in a CDK S3 construct should work.

3 Views

Open in Slack

Previous Next