1

I have a question about how to connect a serverless client with a given AWS Lambda function.

I'm building a system that provides the developers with a cloud-based dev environment. It provides the serverless dev environment built atop the AWS lambda, dynamodb services.

Some developers ask me about how to use the serverless framework in the given environment. For the company's security policy, I can't grant Adimin authority on the developers, so that they find it difficult to perform the sls deploy cmd that requires CRUD authority in the IAM service.

I've tried connecting the serverless client with the aws lambda provided by my system without executing the deploy cmd. But all failed. It requires me to execute the sls deploy cmd before the deploy function cmd.

Is there any way to connect a serverless client with a given AWS Lambda function? If there is a best practice in grating the minimized authority, please give me a suggestion.

Thank you in advance.

Improve this question

1 Answer 1

Reset to default
0

First of all you will need to setup different group with dedicated security groups granting rights to your users. Here's a Cloudformation template for instance, (it references default OrganizationAccountAccessRole but you might/should create your own with minimal access) :

Resources:
  # ADMIN QA
  AssumeAdministratorQARolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: "AdminQA"
      Description: "Assume the qa administrative role"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Sid: "AssumeAdministratorQARolePolicy"
          Effect: "Allow"
          Action:
          - "sts:AssumeRole"
          Resource: "arn:aws:iam::ACCOUNTID:role/OrganizationAccountAccessRole"

  AdminQAGroup:
    Type: AWS::IAM::Group
    Properties: 
      GroupName: AdminQA
      ManagedPolicyArns: 
        - !Ref AssumeAdministratorQARolePolicy

  AdminQAUsersToGroup:
    Type: AWS::IAM::UserToGroupAddition
    Properties: 
      GroupName: !Ref AdminQAGroup
      Users: 
        - MYUSER

Then MYUSER might use this Role through his .aws/credentials like

[default]
aws_access_key_id = KEY
aws_secret_access_key = SECRET

[qa]
role_arn = arn:aws:iam::ACCOUNTID:role/OrganizationAccountAccessRole
source_profile = default

Once again you might update OrganizationAccountAccessRole to your very own Role. Finally during deployment you might use this profile with :

serverless deploy --stage qa --aws-profile qa

Which I recommend to set in package.json directly.

Hope this helps and clarifies how you should grant rights and access through the whole deployment process.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Thank you very much. Let me try what you've told

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.