fix: #114 More secure IoT policy (#115)

* fix: #114 More secure IoT policy

* chore: add contributor

Author: ServerlessLife

README.md

@@ -331,6 +331,7 @@ If you have a new feature idea, please create and issue.
 
 (alphabetical)
 
+- [Ben Moses](https://github.com/benjymoses)
 - [Kristian Dreher](https://www.linkedin.com/in/kristiandreher)
 - [Roger Chi](https://rogerchi.com/)
 - [Sebastian / avocadomaster](https://github.com/avocadomaster)

src/infraDeploy.ts

@@ -37,9 +37,15 @@ const policyDocument = {
   Version: '2012-10-17',
   Statement: [
     {
-      Action: 'iot:*',
-      Resource: '*',
       Effect: 'Allow',
+      Action: [
+        'iot:DescribeEndpoint',
+        'iot:Connect',
+        'iot:Publish',
+        'iot:Subscribe',
+        'iot:Receive',
+      ],
+      Resource: '*',
     },
   ],
 };

test/utils/expectInfraDeployed.ts

@@ -30,14 +30,20 @@ export async function expectInfraDeployed(lambdaName: any) {
       ':layer:LambdaLiveDebugger:',
     );
     expect(policyDocument).toEqual({
+      Version: '2012-10-17',
       Statement: [
         {
-          Action: 'iot:*',
           Effect: 'Allow',
+          Action: [
+            'iot:DescribeEndpoint',
+            'iot:Connect',
+            'iot:Publish',
+            'iot:Subscribe',
+            'iot:Receive',
+          ],
           Resource: '*',
         },
       ],
-      Version: '2012-10-17',
     });
   }
 }