如何使用 CDK Python 创建包含多个语句的 IAM PolicyDocument？

Posted 2023-02-18

【中文标题】如何使用 CDK Python 创建包含多个语句的 IAM PolicyDocument？

【英文标题】：How to create an IAM PolicyDocument with multiple statements using CDK Python?

【发布时间】：2022-01-20 02:26:30

【问题描述】：

我正在尝试使用 cdk 中的 python 编写包含多个语句的 IAM PolicyDocument，但我在任何地方都找不到任何示例。

这是我在 YAML 中的内容，我正在尝试使用 python 在 CDK 中编写。

Lambda:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::Sub: LambdaRole
      Policies:
        - PolicyName:
            Fn::Sub: LambdaPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: ADPermissions
                Effect: Allow
                Action:
                  - ssm:SendCommand
                  - ec2:DescribeInstances
                  - ds:DescribeDirectories
                  - ssm:GetParameter
                  - ssm:PutParameter
                  - ssm:StartAutomationExecution
                  - dynamodb:Scan
                  - dynamodb:Query
                  - sts:AssumeRole
                Resource: "*"
              - Sid: SQS
                Effect: Allow
                Action:
                  - sqs:SendMessage
                Resource:"*"
              - Sid: CloudWatch
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:"*"

我基于 YAML 编写了以下内容，但它给了我错误。对此的任何帮助都非常感谢。

   RolePolicy.add_to_policy(
            iam.PolicyDocument(
                statements = [
                    iam.PolicyStatement(
                        effect = iam.Effect.ALLOW,
                        actions = [
                            'ssm:SendCommand', 
                            'ec2:DescribeInstances', 
                            'ds:DescribeDirectories', 
                            'ssm:GetParameter', 
                            'ssm:PutParameter', 
                            'ssm:StartAutomationExecution', 
                            'sts:AssumeRole'
                        ],
                        resources = ['*']
                     )
                ]
            ),             
            iam.PolicyDocument(
                statements = [
                    iam.PolicyStatement(
                        effect = iam.Effect.ALLOW,
                        actions = [
                            'sqs:SendMessage'
                        ],
                        resources = ['*']
                    )
                ]
            ),            
            iam.PolicyDocument(
                statements = [
                    iam.PolicyStatement(
                        effect = iam.Effect.ALLOW,
                        actions = [
                            'logs:CreateLogGroup', 
                            'logs:CreateLogStream', 
                            'logs:PutLogEvents'
                        ],
                        resources = ['*']
                    )
                ]
            )
        )

【问题讨论】：

“给我错误” - 究竟是什么错误？

很抱歉没有提供错误信息。我是堆栈溢出的新手。我将通过提供更多细节和更好地提出问题来更好地向前推进。谢谢。

【参考方案1】：

该特定 API 仅接受单个语句，例如

RolePolicy.add_to_policy(
    iam.PolicyStatement(
        effect = iam.Effect.ALLOW,
        actions = [
            'ssm:SendCommand', 
            'ec2:DescribeInstances', 
            'ds:DescribeDirectories', 
            'ssm:GetParameter', 
            'ssm:PutParameter', 
            'ssm:StartAutomationExecution', 
            'sts:AssumeRole'
         ],
         resources = ['*']
    )
)

因此，假设 RolePolicy 是 PolicyDocument 类型，您将不得不对每个策略多次调用它。

请参考：https://docs.aws.amazon.com/cdk/api/latest/python/aws_cdk.aws_iam/Role.html#aws_cdk.aws_iam.Role.add_to_policy

或者，您可以调查其他 API 之一，该 API 可让您一次将整个策略附加到角色：https://docs.aws.amazon.com/cdk/api/latest/python/aws_cdk.aws_iam/Role.html#aws_cdk.aws_iam.Role.attach_inline_policy 或 https://docs.aws.amazon.com/cdk/api/latest/python/aws_cdk.aws_iam/Role.html#aws_cdk.aws_iam.Role.add_managed_policy

这里的结构更像：

Role.attach_inline_policy(
    iam.Policy(self, 'Policy',
        statements = [
            iam.PolicyStatement(
                effect = iam.Effect.ALLOW,
                actions = [
                    'ssm:SendCommand', 
                    'ec2:DescribeInstances', 
                    'ds:DescribeDirectories', 
                    'ssm:GetParameter', 
                    'ssm:PutParameter', 
                    'ssm:StartAutomationExecution', 
                    'sts:AssumeRole'
                 ],
                 resources = ['*']
            ),
            iam.PolicyStatement(
                effect = iam.Effect.ALLOW,
                actions = [
                    'sqs:SendMessage'
                ],
                resources = ['*']
            ),
            iam.PolicyStatement(
                effect = iam.Effect.ALLOW,
                actions = [
                    'logs:CreateLogGroup', 
                    'logs:CreateLogStream', 
                    'logs:PutLogEvents'
                ],
                resources = ['*']
            )
        ]
    )
)   

【讨论】：

这行得通，唯一认为缺少的是 iam.Policy 中 ID ('Policy') 旁边的逗号 (,)。非常感谢您为我提供解决方案 Norman。我真的很感激。

太好了，很高兴它成功了！