Open hannes-ucsc opened 2 months ago
The developer
role has ListTags, the azul-gitlab
role does not. Assignee to create PR that adds lambda:GetTags
to the permissions of the azul-gitlab
role, next to where GetFunction
is granted. Assignee to also check other grants of GetFunction
. I checked the service and indexer roles and they don't have it, but I'd like the assignee to verify that we don't need to add GetTags
anywhere but else.
No action required. lambda:GetFunction
is not granted to the azul-gitlab
role, rather lambda:ListFunctions
is. From what I can tell, lamda:ListTags
is not required for lambda:ListFunctions
, only for lambda:GetFunction
.
https://docs.aws.amazon.com/lambda/latest/api/API_ListTags.html
Returns a function's tags. You can also view tags with GetFunction.
Customer managed policies (on dev):
AccessAnalyzerMonitorServicePolicy_FVO5QVBD5V
: Does not grant any lambda:
actions.
cloud_enforcer_policy_platform-hca-dev
: Grants both lambda:GetFunction
and lambda:ListTags
actions.
developer
: Grants both lambda:GetFunction
and lambda:ListTags
actions (via a wildcard allow "NotAction": "iam:*",
).
azul-gitlab_vpc
: Does not grant any lambda:
actions.
azul-gitlab-iam
: Does not grant any lambda:
actions.
azul-boundary
: Grants the lambda:ListFunctions
action
@hannes-ucsc: "The azul-gitlab role does get lambda:GetFunction
from the boundary policy (see screenshot below). Assignee to use the IAM Policy evaluator in the AWS Console in order to reproduce my experiment which led me to believe that azul-gitlab does not have lambda:GetTags
."
Against any resource (*
) the azul-gitlab
role does not have GetFunction
or ListTags
permission.
Against an azul-*
resource (azul-service-dev
), the azul-gitlab
roles does have GetFunction
and ListTags
permissions.
I checked again and cannot reproduce my observation.
Unrelatedly, assignee to remove the cloud_enforcer_policy_platform-hca-dev
policy.
Then close as won't fix.
I don't have the appropriate authorization to remove the cloud_enforcer_policy_platform-hca-dev
policy. From the trail logs:
User: arn:aws:sts::122796619775:assumed-role/developer/achave11@ucsc.edu is not authorized to perform: iam:DeletePolicyVersion on resource: policy arn:aws:iam::122796619775:policy/cloud_enforcer_policy_platform-hca-dev because no identity-based policy allows the iam:DeletePolicyVersion action