2 Respuestas
- Más nuevo
- Más votos
- Más comentarios
1
Found the documentation (that's often the hardest part!) ... seems like resource '*' is what's required.
respondido hace un año
0
Unless there is some security problem with what I did, I think I figured it out:
const role = new iam.Role(this,
"myExecRole_id", {
roleName: "myExecRole",
assumedBy: p
});
role.attachInlinePolicy(new iam.Policy(this, 'describe-endpoint-policy', {
statements: [new iam.PolicyStatement({
actions: ['iot:DescribeEndpoint'],
resources: [*]
})],
}));
though I feel like the resource should be something specific to my account, like
resources: [`arn:aws:iot:*:${this.env.account}:*`]`
That, however, is not correct. The ARN service must not be 'iot' . Maybe it does not matter because the action starts iot: but it seems like I should want to specify a more specific resource than * here?
respondido hace 2 años
Contenido relevante
- OFICIAL DE AWSActualizada hace 3 años
- OFICIAL DE AWSActualizada hace 2 años
Correct! Some IoT APIs will not have resources associated with them, so
*
is appropriate. I use this page to map API calls to what resources can be included in IAM/IoT Policy actions.