Adding pre-defined permissions to auto-generated policy file
- Dominant language
- Python
- Stars
- 11.1k
- Forks
- 1k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 2
Description
Hi,
I'm implementing a REST-API with Chalice which uses S3, Athena and Glue.
Normally, Chalice autogenerated policies work just fine for dev. Although it's not the case when Glue coming into the picture - and maybe others too, I assume.
When trying to deploy the API with autogen policy, Chalice warns me that Glue is unsupported.
```sh
$ chalice deploy
Unsupported service for auto policy generation: glue
Creating deployment package.
Creating IAM role: ...
```
This isn't a big issue, I created the `.chalice/policy-dev.json` manually using the output of `chalice autogen-policy` extended with the glue permissions. This works great with `chalice deploy --no-autogen-policy`.
But my code is not final, and every time I add something that requires different permission I have to edit the `.chalice/policy-dev.json` manually, because `chalice deploy` ignores the `.chalice/policy-dev.json` file.
I've been reading the Chalice docs to figure a way to make this less of a hassle, but it seems like the current implementation supports autogen policy or manual policy but not the mixture of the two. Btw I do not have access to the AWS consoles to do magic there so I need to work with Chalice offers me.
Would be nice if it was possible to specify a policy file that is used by the policy generator as a base to improve on.
What I mean is having a file eg. `.chalice/policy-base.json` with the pre-defined permissions that - now - has to be added manually, like:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"glue:GetTable",
"glue:GetTables",
"glue:GetDatabase"
],
"Resource": [
"arn:aws:glue:*:0123456789012:*"
],
"Sid": "12345000000000000000000000000001"
}, ...
]
}
```
...and would be extended by the policy generator when using `chalice deploy`.
(issues #64, #484, #620 and #985 do not seem to be relevant)
Thanks
Contributor guide
Research direction
Start with the chalice deploy and chalice autogen-policy behavior described in the issue, comparing the generated policy with .chalice/policy-dev.json and the proposed .chalice/policy-base.json. Done means an explicitly defined base policy can be combined with automatically generated permissions during deployment, including the Glue permissions shown here.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- backend-api-design, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100