You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We've been able to work around this by carefully crafting a more compact iam policy, but I'd like to understand if there are more idiomatic ways of doing this in cdk. For example, could we instead have grant prefer to add resource policies over principal policies? Then we'd end up with a bunch of tiny policy documents scattered across our many queues (:partying_face:), rather than having them all accumulate on our iam user (:sob:). Reading the code, I'm pretty sure this isn't possible today, but is this something that's been discussed before? Or are we just going about this all wrong?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
We've got a single iam user with access to send messages to a bunch of sqs queues. If we call
grantSendMessages
for each of these queues, we end up hitting the inline policy size limit for that IAM user. This is because each call tograntSendMessages
callsgrant
, which callsiam.Grant.addToPrincipalOrResource
, which successfully adds the policy to the iam user, and because the user and the queue are in the same AWS account, we stop.We've been able to work around this by carefully crafting a more compact iam policy, but I'd like to understand if there are more idiomatic ways of doing this in cdk. For example, could we instead have
grant
prefer to add resource policies over principal policies? Then we'd end up with a bunch of tiny policy documents scattered across our many queues (:partying_face:), rather than having them all accumulate on our iam user (:sob:). Reading the code, I'm pretty sure this isn't possible today, but is this something that's been discussed before? Or are we just going about this all wrong?Beta Was this translation helpful? Give feedback.
All reactions