2 Risposte
- Più recenti
- Maggior numero di voti
- Maggior numero di commenti
1
Found the documentation (that's often the hardest part!) ... seems like resource '*' is what's required.
con risposta un anno fa
0
Unless there is some security problem with what I did, I think I figured it out:
const role = new iam.Role(this,
"myExecRole_id", {
roleName: "myExecRole",
assumedBy: p
});
role.attachInlinePolicy(new iam.Policy(this, 'describe-endpoint-policy', {
statements: [new iam.PolicyStatement({
actions: ['iot:DescribeEndpoint'],
resources: [*]
})],
}));
though I feel like the resource should be something specific to my account, like
resources: [`arn:aws:iot:*:${this.env.account}:*`]`
That, however, is not correct. The ARN service must not be 'iot' . Maybe it does not matter because the action starts iot: but it seems like I should want to specify a more specific resource than * here?
con risposta 2 anni fa
Contenuto pertinente
- AWS UFFICIALEAggiornata 2 anni fa
- AWS UFFICIALEAggiornata 3 anni fa
Correct! Some IoT APIs will not have resources associated with them, so
*
is appropriate. I use this page to map API calls to what resources can be included in IAM/IoT Policy actions.