Update examples for updated AWS managed policies (pulumi#894)

Co-authored-by: Mikhail Shilkov <[email protected]>
PraveenNanda124 · Jan 29, 2021 · 88e52a4 · 88e52a4
1 parent fa9b2d7
commit 88e52a4
Show file tree

Hide file tree

Showing 19 changed files with 95 additions and 100 deletions.
diff --git a/aws-django-voting-app/__main__.py b/aws-django-voting-app/__main__.py
@@ -87,7 +87,7 @@
 
 # Attaching execution permissions to the exec role
 exec_policy_attachment = aws.iam.RolePolicyAttachment("app-exec-policy", role=app_exec_role.name,
- policy_arn="arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy")
+ policy_arn=aws.iam.ManagedPolicy.AMAZON_ECS_TASK_EXECUTION_ROLE_POLICY)
 
 # Creating an IAM role used by Fargate to manage tasks
 app_task_role = aws.iam.Role("app-task-role",
@@ -106,10 +106,7 @@
 
 # Attaching execution permissions to the task role
 task_policy_attachment = aws.iam.RolePolicyAttachment("app-access-policy", role=app_task_role.name,
- policy_arn="arn:aws:iam::aws:policy/AmazonEC2ContainerServiceFullAccess")
-
-task_policy_attachment = aws.iam.RolePolicyAttachment("app-lambda-policy", role=app_task_role.name,
- policy_arn="arn:aws:iam::aws:policy/AWSLambdaFullAccess")
+ policy_arn=aws.iam.ManagedPolicy.AMAZON_ECS_FULL_ACCESS)
 
 # Creating storage space to upload a docker image of our app to
 app_ecr_repo = aws.ecr.Repository("app-ecr-repo",

diff --git a/aws-fs-lambda-webserver/README.md b/aws-fs-lambda-webserver/README.md
@@ -17,7 +17,7 @@ After cloning this repo, from this working directory, run these commands:
 1. Build and publish the lambda function, making the output available to our Pulumi program. 
 
 ```bash
-dotnet publish ./LambdaWebService
+dotnet publish ./LambdaWebServer
 ```
 
 2. Execute our Pulumi program to archive our published function output, and create our lambda. 

diff --git a/aws-fs-lambda-webserver/pulumi/Program.fs b/aws-fs-lambda-webserver/pulumi/Program.fs
@@ -7,7 +7,7 @@ open Pulumi.Aws.Lambda
 
 module ManagedPolicies =
  let AWSLambdaBasicExecutionRole = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
- let AWSLambdaFullAccess = "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
+ let AWSLambdaExecute = "arn:aws:iam::aws:policy/AWSLambdaExecute"
 
 let openApiSpec (name, arn) =
  let quotedTitle = "\"" + name + "api\""
@@ -57,7 +57,6 @@ let addInvokePermission name accountId functionArn executionArn =
  Action = input "lambda:InvokeFunction",
  Function = functionArn,
  Principal = input "apigateway.amazonaws.com",
- SourceAccount = accountId,
  SourceArn = executionArn,
  StatementIdPrefix = input "lambdaPermission"
  )
@@ -88,14 +87,14 @@ let infra () =
  )
  )
 
- RolePolicyAttachment("lambdaS3ReadOnlyAccess", RolePolicyAttachmentArgs(Role = io lambdaRole.Id, PolicyArn = input ManagedPolicies.AWSLambdaFullAccess)) |> ignore
+ RolePolicyAttachment("lambdaS3ReadOnlyAccess", RolePolicyAttachmentArgs(Role = io lambdaRole.Id, PolicyArn = input ManagedPolicies.AWSLambdaExecute))  |> ignore
  RolePolicyAttachment("lambdaBasicExecution", RolePolicyAttachmentArgs(Role = io lambdaRole.Id, PolicyArn = input ManagedPolicies.AWSLambdaBasicExecutionRole)) |> ignore
 
  let lambda =
  Function(
  "basicLambda",
  FunctionArgs(
- Runtime = input "dotnetcore3.1",
+ Runtime = inputUnion2Of2 Pulumi.Aws.Lambda.Runtime.DotnetCore3d1,
  Code = input (FileArchive "../LambdaWebServer/bin/Debug/netcoreapp3.1/publish" :> Archive),
  Handler = input "LambdaWebServer::Setup+LambdaEntryPoint::FunctionHandlerAsync",
  Role = io lambdaRole.Arn,
@@ -143,4 +142,3 @@ let infra () =
 [<EntryPoint>]
 let main _argv =
  Deployment.run infra
-
diff --git a/aws-py-voting-app/__main__.py b/aws-py-voting-app/__main__.py
@@ -94,10 +94,7 @@
 
 # Attaching execution permissions to the task role
 task_policy_attachment = aws.iam.RolePolicyAttachment("app-access-policy", role=app_task_role.name,
- policy_arn="arn:aws:iam::aws:policy/AmazonEC2ContainerServiceFullAccess")
-
-task_policy_attachment = aws.iam.RolePolicyAttachment("app-lambda-policy", role=app_task_role.name,
- policy_arn="arn:aws:iam::aws:policy/AWSLambdaFullAccess")
+ policy_arn=aws.iam.ManagedPolicy.AMAZON_ECS_FULL_ACCESS)
 
 # Creating storage space to upload a docker image of our app to
 app_ecr_repo = aws.ecr.Repository("app-ecr-repo",

diff --git a/aws-ts-apigatewayv2-http-api-quickcreate/index.ts b/aws-ts-apigatewayv2-http-api-quickcreate/index.ts
@@ -23,7 +23,7 @@ const lambdaRole = new aws.iam.Role("lambdaRole", {
 // Attach the fullaccess policy to the Lambda role created above
 const rolepolicyattachment = new aws.iam.RolePolicyAttachment("lambdaRoleAttachment", {
  role: lambdaRole,
- policyArn: aws.iam.ManagedPolicies.AWSLambdaFullAccess,
+ policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole,
 });
 
 // Create the Lambda to execute

diff --git a/aws-ts-apigatewayv2-http-api-quickcreate/package.json b/aws-ts-apigatewayv2-http-api-quickcreate/package.json
@@ -4,8 +4,8 @@
  "@types/node": "^10.0.0"
  },
  "dependencies": {
- "@pulumi/aws": "^3.0.0",
- "@pulumi/awsx": "^0.23.0",
+ "@pulumi/aws": "^3.25.1",
+ "@pulumi/awsx": "^0.24.0",
  "@pulumi/pulumi": "^2.0.0"
  }
 }
diff --git a/aws-ts-apigatewayv2-http-api/index.ts b/aws-ts-apigatewayv2-http-api/index.ts
@@ -33,9 +33,9 @@ const lambdaRole = new aws.iam.Role("lambdaRole", {
  },
 });
 
-const lambadRoleAttachment = new aws.iam.RolePolicyAttachment("lambdaRoleAttachment", {
+const lambdaRoleAttachment = new aws.iam.RolePolicyAttachment("lambdaRoleAttachment", {
  role: lambdaRole,
- policyArn: aws.iam.ManagedPolicies.AWSLambdaFullAccess,
+ policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole,
 });
 
 const lambda = new aws.lambda.Function("lambdaFunction", {

diff --git a/aws-ts-apigatewayv2-http-api/package.json b/aws-ts-apigatewayv2-http-api/package.json
@@ -4,8 +4,8 @@
  "@types/node": "^10.0.0"
  },
  "dependencies": {
- "@pulumi/aws": "^3.0.0",
- "@pulumi/awsx": "^0.23.0",
+ "@pulumi/aws": "^3.25.1",
+ "@pulumi/awsx": "^0.24.0",
  "@pulumi/pulumi": "^2.0.0"
  }
 }
diff --git a/aws-ts-lambda-efs/README.md b/aws-ts-lambda-efs/README.md
@@ -130,7 +130,7 @@ After cloning this repo, `cd` into it and run these commands:
 
  ```bash
  $ curl -X POST -d '<h1>Hello world</h1>' $(pulumi stack output url)files/index.html
- $ curl -X GET $(pulumi stack output url)files/file.txt
+ $ curl -X GET $(pulumi stack output url)files/index.html
  <h1>Hello world</h1>
  ```
 

diff --git a/aws-ts-lambda-efs/index.ts b/aws-ts-lambda-efs/index.ts
@@ -30,7 +30,7 @@ export = async () => {
  // Lambda
  function efsvpcCallback(name: string, f: aws.lambda.Callback<awsx.apigateway.Request, awsx.apigateway.Response>) {
  return new aws.lambda.CallbackFunction(name, {
- policies: [aws.iam.ManagedPolicies.AWSLambdaVPCAccessExecutionRole, aws.iam.ManagedPolicies.AWSLambdaFullAccess],
+ policies: [aws.iam.ManagedPolicy.AWSLambdaVPCAccessExecutionRole, aws.iam.ManagedPolicy.LambdaFullAccess],
  vpcConfig: {
  subnetIds: vpc.privateSubnetIds,
  securityGroupIds: [vpc.vpc.defaultSecurityGroupId],

diff --git a/aws-ts-lambda-efs/package.json b/aws-ts-lambda-efs/package.json
@@ -2,8 +2,8 @@
  "name": "aws-ts-lambda-efs",
  "version": "0.1.0",
  "dependencies": {
- "@pulumi/aws": "^3.0.0",
- "@pulumi/awsx": "^0.23.0",
+ "@pulumi/aws": "^3.25.1",
+ "@pulumi/awsx": "^0.24.0",
  "@pulumi/pulumi": "^2.0.0"
  }
 }
diff --git a/aws-ts-lambda-thumbnailer/index.ts b/aws-ts-lambda-thumbnailer/index.ts
@@ -12,9 +12,9 @@ const image = awsx.ecr.buildAndPushImage("sampleapp", {
 const role = new aws.iam.Role("thumbnailerRole", {
  assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "lambda.amazonaws.com" }),
 });
-const lambdaFullAccess = new aws.iam.RolePolicyAttachment("lambdaFullAccess", {
+const lambdaS3Access = new aws.iam.RolePolicyAttachment("lambdaFullAccess", {
  role: role.name,
- policyArn: aws.iam.ManagedPolicies.AWSLambdaFullAccess,
+ policyArn: aws.iam.ManagedPolicy.AWSLambdaExecute,
 });
 
 const thumbnailer = new aws.lambda.Function("thumbnailer", {
@@ -44,6 +44,6 @@ bucket.onObjectCreated("onNewThumbnail", new aws.lambda.CallbackFunction<aws.s3.
  }
  },
  policies: [
- aws.iam.ManagedPolicies.AWSLambdaFullAccess, // Provides wide access to "serverless" services (Dynamo, S3, etc.)
+ aws.iam.ManagedPolicy.AWSLambdaExecute, // Provides wide access to Lambda and S3
  ],
 }), { filterSuffix: ".jpg" });
diff --git a/aws-ts-lambda-thumbnailer/package.json b/aws-ts-lambda-thumbnailer/package.json
@@ -4,7 +4,7 @@
  "main": "index.js",
  "dependencies": {
  "@pulumi/pulumi": "^2.0.0",
- "@pulumi/aws": "^3.17.0",
- "@pulumi/awsx": "^0.23.0"
+ "@pulumi/aws": "^3.25.1",
+ "@pulumi/awsx": "^0.24.0"
  }
 }
diff --git a/aws-ts-serverless-datawarehouse/datawarehouse/lambdaCron/index.ts b/aws-ts-serverless-datawarehouse/datawarehouse/lambdaCron/index.ts
@@ -41,10 +41,10 @@ export class LambdaCronJob extends pulumi.ComponentResource {
  }
  }
 
- // always attach the lambda policy for logging, etc.
+ // always attach the lambda policy for logging
  const loggingAttachment = new aws.iam.RolePolicyAttachment(`${name}-Attachment-lambda`, {
  role: partitionRole,
- policyArn: aws.iam.ManagedPolicies.AWSLambdaFullAccess,
+ policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole,
  }, options);
 
  const cron = new aws.cloudwatch.EventRule(`${name}-cron`, {

diff --git a/aws-ts-thumbnailer/index.ts b/aws-ts-thumbnailer/index.ts
@@ -25,8 +25,8 @@ const ffmpegThumbnailTask = new awsx.ecs.FargateTaskDefinition("ffmpegThumbTask"
 bucket.onObjectCreated("onNewVideo", new aws.lambda.CallbackFunction<aws.s3.BucketEvent, void>("onNewVideo", {
  // Specify appropriate policies so that this AWS lambda can run EC2 tasks.
  policies: [
- aws.iam.ManagedPolicies.AWSLambdaFullAccess, // Provides wide access to "serverless" services (Dynamo, S3, etc.)
- aws.iam.ManagedPolicies.AmazonEC2ContainerServiceFullAccess, // Required for lambda compute to be able to run Tasks
+ aws.iam.ManagedPolicy.AWSLambdaExecute, // Provides access to logging and S3
+ aws.iam.ManagedPolicy.AmazonECSFullAccess,  // Required for lambda compute to be able to run Tasks
  ],
  callback: async bucketArgs => {
  console.log("onNewVideo called");

diff --git a/aws-ts-thumbnailer/package.json b/aws-ts-thumbnailer/package.json
@@ -4,7 +4,7 @@
  "main": "index.js",
  "dependencies": {
  "@pulumi/pulumi": "^2.0.0",
- "@pulumi/aws": "^3.0.0",
- "@pulumi/awsx": "^0.23.0"
+ "@pulumi/aws": "^3.25.1",
+ "@pulumi/awsx": "^0.24.0"
  }
 }
diff --git a/cloud-js-thumbnailer-machine-learning/Pulumi.yaml b/cloud-js-thumbnailer-machine-learning/Pulumi.yaml
@@ -11,4 +11,4 @@ template:
  default: true
  cloud-aws:computeIAMRolePolicyARNs:
  description: The IAM role policies to apply to compute (both Lambda and ECS) within this Pulumi program
- default: arn:aws:iam::aws:policy/AWSLambdaFullAccess,arn:aws:iam::aws:policy/AmazonEC2ContainerServiceFullAccess,arn:aws:iam::aws:policy/AmazonRekognitionFullAccess
+ default: arn:aws:iam::aws:policy/AWSLambdaExecute,arn:aws:iam::aws:policy/AWSLambda_FullAccess,arn:aws:iam::aws:policy/AmazonECS_FullAccess,arn:aws:iam::aws:policy/AmazonRekognitionFullAccess,arn:aws:iam::aws:policy/IAMFullAccess