Slide 22
Slide 22 text
スタック定義 (IAM Role) 22
FullAccessDestinationBucket: new PolicyDocument({
statements: [new PolicyStatement({
effect: Effect.ALLOW,
actions: [
's3:*',
],
resources: [
destinationBucket.bucketArn,
`${destinationBucket.bucketArn}/*`,
],
})]
}),
}
});
lambdaRole.addManagedPolicy(
cdk.aws_iam.ManagedPolicy.fromAwsManagedPolicyName(
'service-role/AWSLambdaBasicExecutionRole'
));
// IAM Role for Lambda
const lambdaRole = new Role(this, 'LambdaRole', {
roleName: `${props?.projectName}-lambda-role`,
assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
inlinePolicies: {
ReadOnlySourceBucket: new PolicyDocument({
statements: [new PolicyStatement({
effect: Effect.ALLOW,
actions: [
's3:Get*',
's3:List*',
],
resources: [
sourceBucket.bucketArn,
`${sourceBucket.bucketArn}/*`,
],
})]
}),
l LambdaにアタッチするIAMロールを定義