search

jorgebastida / gordon

λ Gordon is a tool to create, wire and deploy AWS Lambdas using CloudFormation
Other
2.05k stars 137 forks source link

iam:GetRole still needed #144

Open candlerb opened 7 years ago

candlerb commented 7 years ago

According to changelog comment 44e92e72, "Adding aws-account-id to your settings will make gordon not require any IAM permissions" as of commit fba74a05.

But this needs clarification. Whilst gordon itself may not perform an IAM lookup, it still needs IAM permissions in order to deploy a stack.

Even when providing aws-account-id I still needed to provide these or else I got cloudformation failures:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1503051480000",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:PutRolePolicy",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:GetRole"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

The first four were required to get as far as creating the stack, and GetRole seems to be required as part of lambda deployment:

CREATE_FAILED | AWS::Lambda::Function | ContribLambdasVersion | AccessDenied. User doesn't have permission to call iam:GetRole

Relates to #124.