Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow lambda security group access to cache security group in CDK stack #109

Merged
merged 2 commits into from
Jan 25, 2021
Merged

Allow lambda security group access to cache security group in CDK stack #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e02d76
Implemented a custom security group for lambda, which grants access t…
leothomas Jan 25, 2021
77fd623
updated iam policy statement naming for clarity
leothomas Jan 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
cdk.out
*.tif
cdk.out/*
*.tif
35 changes: 29 additions & 6 deletions stack/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
from aws_cdk import aws_iam as iam
from aws_cdk import aws_lambda, aws_s3, core

iam_policy_statement = iam.PolicyStatement(
s3_full_access_to_data_bucket = iam.PolicyStatement(
actions=["s3:*"], resources=[f"arn:aws:s3:::{config.BUCKET}*"]
)

Expand Down Expand Up @@ -73,22 +73,43 @@ def __init__(
subnet_ids=[sb.subnet_id for sb in vpc.private_subnets],
)

sg = ec2.SecurityGroup(self, f"{id}-cache-sg", vpc=vpc)
lambda_function_security_group = ec2.SecurityGroup(
self, f"{id}-lambda-sg", vpc=vpc
)
lambda_function_security_group.add_egress_rule(
ec2.Peer.any_ipv4(),
connection=ec2.Port(protocol=ec2.Protocol("ALL"), string_representation=""),
description="Allow lambda security group all outbound access",
)

cache_security_group = ec2.SecurityGroup(self, f"{id}-cache-sg", vpc=vpc)

cache_security_group.add_ingress_rule(
lambda_function_security_group,
connection=ec2.Port(protocol=ec2.Protocol("ALL"), string_representation=""),
description="Allow Lambda security group access to Cache security group",
)

cache = escache.CfnCacheCluster(
self,
f"{id}-cache",
cache_node_type=config.CACHE_NODE_TYPE,
engine=config.CACHE_ENGINE,
num_cache_nodes=config.CACHE_NODE_NUM,
vpc_security_group_ids=[sg.security_group_id],
vpc_security_group_ids=[cache_security_group.security_group_id],
cache_subnet_group_name=sb_group.ref,
)

vpc_access_policy_statement = iam.PolicyStatement(
logs_access = iam.PolicyStatement(
actions=[
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
],
resources=["*"],
)
ec2_network_access = iam.PolicyStatement(
actions=[
"ec2:CreateNetworkInterface",
"ec2:DescribeNetworkInterfaces",
"ec2:DeleteNetworkInterface",
Expand Down Expand Up @@ -121,10 +142,12 @@ def __init__(
reserved_concurrent_executions=concurrent,
timeout=core.Duration.seconds(timeout),
environment=lambda_env,
security_groups=[lambda_function_security_group],
vpc=vpc,
)
lambda_function.add_to_role_policy(iam_policy_statement)
lambda_function.add_to_role_policy(vpc_access_policy_statement)
lambda_function.add_to_role_policy(s3_full_access_to_data_bucket)
lambda_function.add_to_role_policy(logs_access)
lambda_function.add_to_role_policy(ec2_network_access)

# defines an API Gateway Http API resource backed by our "dynamoLambda" function.
apigw.HttpApi(
Expand Down