Scope down log permissions in Lambda shortcut(s)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 74
- Forks
- 10
- PR merge metrics
- No merged PRs in 30d
Description
The Lambda shortcut in this repo currently grants `logs:*` access, i.e. access to all actions for the log group created by this shortcut:
https://github.com/mapbox/cloudfriend/blob/05aa50b75a6930329f7fb41b3fb21f6f5fe1fa8f/lib/shortcuts/lambda.js#L147-L151
While it's good that this permission is scoped to only the single log group resource, I wonder if we should scope down the actions Lambda functions have access to, by default? Based on other examples, it seems like the only actions required for typical log-writing functionality are:
```
'logs:CreateLogStream',
'logs:PutLogEvents',
'logs:DescribeLogStreams'
```
Any reasoning or discussion surrounding scoping down `logs:*` permissions?
/cc: @rclark @williamhammond
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read lib/shortcuts/lambda.js at lines 147-151 and review the Lambda shortcut's log-group permissions. Compare the current logs:* grant with the listed CreateLogStream, PutLogEvents, and DescribeLogStreams actions; the work is done when the shortcut grants only the required log-writing actions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, javascript
- Domain
- cloud, security
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100