2개 답변
- 최신
- 최다 투표
- 가장 많은 댓글
1
Found the documentation (that's often the hardest part!) ... seems like resource '*' is what's required.
답변함 일 년 전
0
Unless there is some security problem with what I did, I think I figured it out:
const role = new iam.Role(this,
"myExecRole_id", {
roleName: "myExecRole",
assumedBy: p
});
role.attachInlinePolicy(new iam.Policy(this, 'describe-endpoint-policy', {
statements: [new iam.PolicyStatement({
actions: ['iot:DescribeEndpoint'],
resources: [*]
})],
}));
though I feel like the resource should be something specific to my account, like
resources: [`arn:aws:iot:*:${this.env.account}:*`]`
That, however, is not correct. The ARN service must not be 'iot' . Maybe it does not matter because the action starts iot: but it seems like I should want to specify a more specific resource than * here?
답변함 일 년 전
관련 콘텐츠
- AWS 공식업데이트됨 일 년 전
Correct! Some IoT APIs will not have resources associated with them, so
*
is appropriate. I use this page to map API calls to what resources can be included in IAM/IoT Policy actions.