2 個答案
- 最新
- 最多得票
- 最多評論
1
Found the documentation (that's often the hardest part!) ... seems like resource '*' is what's required.
已回答 1 年前
0
Unless there is some security problem with what I did, I think I figured it out:
const role = new iam.Role(this,
"myExecRole_id", {
roleName: "myExecRole",
assumedBy: p
});
role.attachInlinePolicy(new iam.Policy(this, 'describe-endpoint-policy', {
statements: [new iam.PolicyStatement({
actions: ['iot:DescribeEndpoint'],
resources: [*]
})],
}));
though I feel like the resource should be something specific to my account, like
resources: [`arn:aws:iot:*:${this.env.account}:*`]`
That, however, is not correct. The ARN service must not be 'iot' . Maybe it does not matter because the action starts iot: but it seems like I should want to specify a more specific resource than * here?
已回答 2 年前
相關內容
- 已提問 1 年前
- AWS 官方已更新 2 年前
- AWS 官方已更新 1 年前
- AWS 官方已更新 2 年前
Correct! Some IoT APIs will not have resources associated with them, so
*
is appropriate. I use this page to map API calls to what resources can be included in IAM/IoT Policy actions.