udondan
commented
3 years ago Hi @akefirad,
the method addServicePrincipal is actually not part of the Floyd package. All the IAM statement classes in the Floyd package extend iam.PolicyStatement from the CDK itself. That's where this method comes from. Nothing wrong with directly using it, but yeah, it returns void.
Floyd though provides other methods for adding principals. For a service principal there is .forService('...'):
const policy = new statement.Sns()
.allow()
.toPublish()
.onTopic(myTopic)
.forService('ses.amazonaws.com')Alternatively you can also directly use CDK principals:
const policy = new statement.Sns()
.allow()
.toPublish()
.onTopic(myTopic)
.forCdkPrincipal(
new iam.ServicePrincipal('ses.amazonaws.com')
)Implementing something like you envision (e.g. .forServiceSes()) would be possible, but I would like to not get into the business of manually managing services valid for referencing as a principal. So this would probably involve scraping this document. But how to get from the table content to the actual service names... that seems to be the tricky part. Also, there seems to be no indicator in the IAM service description itself if a service can be used in a service role, e.g. SES. Neither the domain (ses.amazonaws.com) is listed there... I'm not 100% sure it always is the service prefix (ses) with an appended .amazonaws.com.
But yeah, I agree, it would be cool to have this functionality. In fact, looking up the service domains for principals is one of the rare cases where I still have to go to the AWS IAM docs.
Cheers, Daniel
akefirad
Is there any plan to support this? For example:
Any help you need with this? BTW: what's the reason
addServicePrincipalreturnsvoidand notthis?