Skip to content

Commit 9c43eec

Browse files
jusdinojusdino
committed
Fix appliesTo suppressions
1 parent ac7c886 commit 9c43eec

File tree

10 files changed

+42
-17
lines changed

10 files changed

+42
-17
lines changed

‎backend/compact-connect/common_constructs/nodejs_function.py

+5-3
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ def __init__(
7171
suppressions=[
7272
{
7373
'id': 'AwsSolutions-IAM4',
74-
'applies_to': [
74+
'appliesTo': [
7575
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
7676
],
7777
'reason': 'The BasicExecutionRole policy is appropriate for these lambdas',
@@ -84,7 +84,9 @@ def __init__(
8484
suppressions=[
8585
{
8686
'id': 'AwsSolutions-IAM4',
87-
'applies_to': 'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole', # noqa: E501 line-too-long
87+
'appliesTo': [
88+
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
89+
], # noqa: E501 line-too-long
8890
'reason': 'This policy is appropriate for the log retention lambda',
8991
},
9092
],
@@ -95,7 +97,7 @@ def __init__(
9597
suppressions=[
9698
{
9799
'id': 'AwsSolutions-IAM5',
98-
'applies_to': ['Resource::*'],
100+
'appliesTo': ['Resource::*'],
99101
'reason': 'This lambda needs to be able to configure log groups across the account, though the'
100102
' actions it is allowed are scoped specifically for this task.',
101103
},

‎backend/compact-connect/common_constructs/python_function.py

+5-3
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ def __init__(
8585
suppressions=[
8686
{
8787
'id': 'AwsSolutions-IAM4',
88-
'applies_to': [
88+
'appliesTo': [
8989
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
9090
],
9191
'reason': 'The BasicExecutionRole policy is appropriate for these lambdas',
@@ -98,7 +98,9 @@ def __init__(
9898
suppressions=[
9999
{
100100
'id': 'AwsSolutions-IAM4',
101-
'applies_to': 'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole', # noqa: E501 line-too-long
101+
'appliesTo': [
102+
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
103+
], # noqa: E501 line-too-long
102104
'reason': 'This policy is appropriate for the log retention lambda',
103105
},
104106
],
@@ -109,7 +111,7 @@ def __init__(
109111
suppressions=[
110112
{
111113
'id': 'AwsSolutions-IAM5',
112-
'applies_to': ['Resource::*'],
114+
'appliesTo': ['Resource::*'],
113115
'reason': 'This lambda needs to be able to configure log groups across the account, though the'
114116
' actions it is allowed are scoped specifically for this task.',
115117
},

‎backend/compact-connect/common_constructs/slack_channel_configuration.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ def _configure_chatbot_role(self):
3737
suppressions=[
3838
{
3939
'id': 'AwsSolutions-IAM4',
40-
'applies_to': ['Policy::arn:<AWS::Partition>:iam::aws:policy/job-function/ViewOnlyAccess'],
40+
'appliesTo': ['Policy::arn:<AWS::Partition>:iam::aws:policy/job-function/ViewOnlyAccess'],
4141
'reason': 'This role is general-purpose for operations integration and the AWS-managed '
4242
'ViewOnlyAccess policy is suitable',
4343
},

‎backend/compact-connect/stacks/api_stack/cc_api.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ def __init__(
211211
suppressions=[
212212
{
213213
'id': 'AwsSolutions-IAM4',
214-
'applies_to': [
214+
'appliesTo': [
215215
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
216216
],
217217
'reason': 'This policy is crafted specifically for the account-level role created here.',

‎backend/compact-connect/stacks/api_stack/v1_api/query_providers.py

+5-1
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,11 @@ def _query_providers_handler(
182182
suppressions=[
183183
{
184184
'id': 'AwsSolutions-IAM5',
185-
'applies_to': ['Action::kms:GenerateDataKey*', 'Action::kms:ReEncrypt*'],
185+
'appliesTo': [
186+
'Action::kms:GenerateDataKey*',
187+
'Action::kms:ReEncrypt*',
188+
'Resource::<ProviderTableEC5D0597.Arn>/index/*',
189+
],
186190
'reason': 'The actions in this policy are specifically what this lambda needs to read '
187191
'and is scoped to one table and encryption key.',
188192
},

‎backend/compact-connect/stacks/persistent_stack/bulk_uploads_bucket.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ def _add_v1_ingest_object_events(self, event_bus: EventBus):
132132
suppressions=[
133133
{
134134
'id': 'AwsSolutions-IAM5',
135-
'applies_to': ['Resource::*'],
135+
'appliesTo': ['Resource::*'],
136136
'reason': """
137137
The lambda policy is scoped specifically to the PutBucketNotification action, which
138138
suits its purpose.
@@ -146,7 +146,7 @@ def _add_v1_ingest_object_events(self, event_bus: EventBus):
146146
suppressions=[
147147
{
148148
'id': 'AwsSolutions-IAM4',
149-
'applies_to': [
149+
'appliesTo': [
150150
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
151151
],
152152
'reason': 'The BasicExecutionRole policy is appropriate for this lambda',

‎backend/compact-connect/stacks/persistent_stack/compact_configuration_upload.py

+3-1
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,9 @@ def __init__(
106106
suppressions=[
107107
{
108108
'id': 'AwsSolutions-IAM4',
109-
'applies_to': 'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole', # noqa: E501 line-too-long
109+
'appliesTo': [
110+
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
111+
], # noqa: E501 line-too-long
110112
'reason': 'This policy is appropriate for the log retention lambda',
111113
},
112114
],

‎backend/compact-connect/stacks/persistent_stack/provider_users_bucket.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ def _add_v1_object_events(self, provider_table: Table, encryption_key: IKey):
131131
suppressions=[
132132
{
133133
'id': 'AwsSolutions-IAM5',
134-
'applies_to': ['Resource::*'],
134+
'appliesTo': ['Resource::*'],
135135
'reason': """
136136
The lambda policy is scoped specifically to the PutBucketNotification action, which
137137
suits its purpose.
@@ -145,7 +145,7 @@ def _add_v1_object_events(self, provider_table: Table, encryption_key: IKey):
145145
suppressions=[
146146
{
147147
'id': 'AwsSolutions-IAM4',
148-
'applies_to': [
148+
'appliesTo': [
149149
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
150150
],
151151
'reason': 'The BasicExecutionRole policy is appropriate for this lambda',

‎backend/compact-connect/stacks/persistent_stack/ssn_table.py

+17-2
Original file line numberDiff line numberDiff line change
@@ -142,16 +142,31 @@ def _configure_access(self):
142142
self.key.grant_encrypt_decrypt(self.ingest_role)
143143

144144
def _role_suppressions(self, role: Role):
145+
stack = Stack.of(role)
145146
NagSuppressions.add_resource_suppressions_by_path(
146-
Stack.of(role),
147+
stack,
147148
f'{role.node.path}/Resource',
148149
suppressions=[
149150
{
150151
'id': 'AwsSolutions-IAM4',
151-
'applies_to': [
152+
'appliesTo': [
152153
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
153154
],
154155
'reason': 'The BasicExecutionRole policy is appropriate for these lambdas',
155156
},
156157
],
157158
)
159+
NagSuppressions.add_resource_suppressions_by_path(
160+
stack,
161+
f'{role.node.path}/DefaultPolicy/Resource',
162+
suppressions=[
163+
{
164+
'id': 'AwsSolutions-IAM5',
165+
'appliesTo': [f'Resource::<{stack.get_logical_id(self.node.default_child)}.Arn>/index/*'],
166+
'reason': """
167+
This policy contains wild-carded actions and resources but they are scoped to the
168+
specific actions, KMS key and Table that this lambda specifically needs access to.
169+
""",
170+
},
171+
],
172+
)

‎backend/compact-connect/stacks/ui_stack/distribution.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ def __init__(
8484
suppressions=[
8585
{
8686
'id': 'AwsSolutions-IAM4',
87-
'applies_to': [
87+
'appliesTo': [
8888
'Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
8989
],
9090
'reason': 'This policy enables CloudWatch logging and is appropriate for this lambda',

0 commit comments

Comments
 (0)