问题描述
根据文档 here,dynamodb 自动扩展有一个服务相关角色 - AWSServiceRoleForApplicationAutoScaling_DynamoDBTable。 角色权限策略允许 Application Auto Scaling 对所有资源完成以下操作:
Action: dynamodb:DescribeTable
Action: dynamodb:UpdateTable
Action: cloudwatch:Deletealarms
Action: cloudwatch:DescribeAlarms
Action: cloudwatch:PutMetricAlarm
翻译成(来自here),
{
"Version": "2012-10-17","Statement": [
{
"Effect": "Allow","Action": [
"dynamodb:DescribeTable","dynamodb:UpdateTable","cloudwatch:Deletealarms","cloudwatch:DescribeAlarms","cloudwatch:PutMetricAlarm"
],"Resource": "*"
}
]
}
例如,当使用如下策略时,
TableLiveProductsReadscalableTarget:
Type: 'AWS::ApplicationAutoScaling::scalableTarget'
Properties:
MaxCapacity: !Ref TableLiveProductsReadMaxCap
MinCapacity: !Ref TableLiveProductsReadMinCap
ResourceId: !Sub "table/${TableLiveProducts}"
RoleARN: !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable
scalableDimension: 'dynamodb:table:ReadCapacityUnits'
ServiceNamespace: dynamodb
从安全角度来看是否可以假设,因为角色只能由 dynamodb.application-autoscaling.amazonaws.com
承担没有问题授予更新 ALL
表、删除 ALL
警报等的权限.?
在此处(以及在许多 AWS 构建的服务相关角色中)要求此类通配符权限背后的基本原理是什么?
解决方法
它们对于您的帐户来说是最通用的。因此,一个角色为您覆盖每张桌子。由于原则是 dynamodb.application-autoscaling.amazonaws.com
,没有其他服务或 IAM 用户/角色可以使用这些权限。
您可以提供您自己的角色,并进行更细致的设置。因此,要将权限限制为只有一张表,您可以执行以下操作:
MyDynamoDBRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: {'Service': ['dynamodb.application-autoscaling.amazonaws.com']}
Action: ['sts:AssumeRole']
Path: '/'
Policies:
- PolicyName: DynamoDBScaling
PolicyDocument: !Sub |
{
"Version": "2012-10-17","Statement": [
{
"Effect": "Allow","Action": [
"dynamodb:DescribeTable","dynamodb:UpdateTable"
],"Resource": "${TableLiveProducts.Arn}"
},{
"Effect": "Allow","Action": [
"cloudwatch:PutMetricAlarm","cloudwatch:DescribeAlarms","cloudwatch:DeleteAlarms"
],"Resource": "*"
}
]
}
TableLiveProductsReadScalableTarget:
Type: 'AWS::ApplicationAutoScaling::ScalableTarget'
Properties:
MaxCapacity: !Ref TableLiveProductsReadMaxCap
MinCapacity: !Ref TableLiveProductsReadMinCap
ResourceId: !Sub "table/${TableLiveProducts}"
RoleARN: !GetAtt MyDynamoDBRole.Arn
ScalableDimension: 'dynamodb:table:ReadCapacityUnits'
ServiceNamespace: dynamodb