Lock down IAM permissions about open-api HOT 3 CLOSED

Removed S3 access for the Lambda. Next is creating an AWS account in the freeCodeCamp account, using a locked down policy generated with https://github.com/dancrumb/generator-serverless-policy

from open-api.

I've moved the app from my account to freecodecamp. The generated policy did not really deliver. The tool has not been updated, and was missing permissions, and plugins that create notifications and alarms are a party pooper too.

My plan b:

I've given admin access to the serverless user, and I'll review permissions used by that user to create a new policy.

We can use cloudtrail to review access had at https://console.aws.amazon.com/cloudtrail/home?region=us-east-1#/events

I've downloaded the events and will have a look at this later, probably tomorrow.

Related blog post to potentially use for reference https://threatresponse.cloud/blog/2016/tips_for_least_privilege_iam_policies.html

from open-api.

I've removed the policy I initially added, and created one using the visual editor. In the long run having a nice version under version control, preferably managed by a tool like Terraform is desirable.

For now, we have a versioned policy in place, that only has permissions for services touched by serverless deployments and where possible locked down to resources that include openapi* in the ARN.

TL;DR user serverless no longer has admin permissions but a custom policy.

from open-api.