Limit IAM role statement access by tag - serverless

user_9732470 0
Viewed 121

I'm trying to give access to a lambda function to manage (create/destroy, etc) route53 resources but only those that have a specific tag key and value pair. This is the relevant portion of the serverless.yaml file:

provider:
  name: aws
  runtime: nodejs14.x

  iam:
    role:
      statements:
        - Effect: "Allow"
          Action: "route53:*"
          Resource: "*"
          # Condition: ??

functions:
  lambda:
    handler: index.handler

Basically do this but with serverless. Thanks in advance!

aws-lambda serverless-framework amazon-web-services
1 Answers

After some digging, I found a reference from serverless docs in the IAM permissions section so the solution would be like this:


provider:
  name: aws
  runtime: nodejs14.x

  iam:
    role:
      statements:
        - Effect: "Allow"
          Action: "route53:*"
          Resource: "*"
          Condition:
            StringEquals:
              aws:ResourceTag/key: "value"

functions:
  lambda:
    handler: index.handler
user_97324700
Related