The following CDK code
const queue = new sqs.Queue(this, 'my-sqs-queue', {
visibilityTimeout: cdk.Duration.seconds(300)
});
const role = iam.Role.fromRoleArn(this, "myrole", "arn:aws:iam::1234:role/myrole")
const evtHandler = new lambda.Function(this, 'MyLambda', {
code: lambda.Code.fromInline(`
exports.handler = async function(event, context) {
console.log("EVENT: \n" + JSON.stringify(event, null, 2))
return context.logStreamName
}`),
handler: 'index.handler',
runtime: lambda.Runtime.NODEJS_8_10,
role
});
evtHandler.addEventSource(new SqsEventSource(queue, {
batchSize: 10 // default
}));
will set up a lambda that polls SQS. Awesome! However, it also generates this CF
myrolePolicy99283C52:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action:
- sqs:ReceiveMessage
- sqs:ChangeMessageVisibility
- sqs:GetQueueUrl
- sqs:DeleteMessage
- sqs:GetQueueAttributes
Effect: Allow
Resource:
Fn::GetAtt:
- sqseventloaderusw2tstF27FC9C7
- Arn
Version: "2012-10-17"
PolicyName: snssqslambdaPolicy16AEE704
Roles:
- myrole
The problem is, myrole already has a policy that will allow those things. It also means the thing executing this script needs to have permissions to create/update Policies/Roles :(
Security in my org will not be super happy with allowing that kind of thing. Is there a way to stop it from generating policies and attaching them to roles?