Use IAM roles per function

Purpose

One of the ways to mitigate security risks for serverless applications is to use the principle of least privilege for function permissions. When a default IAM role is defined for a serverless service, each function receives all the permissions defined for the default role. This can lead to overly broad function permissions, which violates the principle. Each function should be granted the minimum set of permissions required to complete the job of the function.

This change removes all default lambda execution roles and adds per-function roles with the minimum permissions to execute the function handlers, and adds a section to the services README that explains this as a best practice for serverless security.

Linked Issues to Close

N/A

Approach

It's possible to define custom IAM roles, but if you do so you need to manually handle the details of defining IAM permissions for logs and stream events that are usually abstracted away by the Serverless framework.

This change uses the serverless-iam-roles-per-function plugin, which allows defining custom roles for each function while still abstracting away the permissions that are required for all serverless functions. This plugin is recommended in the Serverless documentation for IAM permissions.

Learning

Assorted Notes/Considerations

Manual testing:

I deployed each service after adding per-function IAM roles, and tested each function to confirm that it still had the required IAM permissions to execute without error.

Pull Request Creator Checklist

[ ] This PR has an associated issue or issues.
[ ] The associated issue(s) are linked above.
[ ] This PR meets all acceptance criteria for those issues.
[ ] This PR and linked issue(s) are adequately documented
[ ] This PR and linked issues(s) are a complete description of the changeset; an individual or team should be able to understand the issue(s) and changes by reading through this PR and it's links, with no further interaction.
[ ] Someone has been assigned this PR.
[ ] At least one person has been marked as reviewer on this PR.

Pull Request Reviewer/Assignee Checklist

[ ] This PR has an associated issue or issues.
[ ] The associated issue(s) are linked above.
[ ] This PR meets all acceptance criteria for those issues.
[ ] This PR and linked issue(s) are adequately documented
[ ] This PR and linked issues(s) are a complete description of the changeset; an individual or team should be able to understand the issue(s) and changes by reading through this PR and it's links, with no further interaction.

Enterprise-CMCS / macpro-quickstart-serverless