@@ -25,6 +25,7 @@ def get_partition(region):
2525 return 'aws-us-gov'
2626 return 'aws'
2727
28+
2829def check_resource (region , cluster_name , aws_access_key_id , aws_secret_access_key , resource_type ,resource_value ):
2930
3031 # Loop over all supported resource checks
@@ -56,11 +57,13 @@ def check_resource(region, cluster_name, aws_access_key_id, aws_secret_access_ke
5657 (['sqs:SendMessage' , 'sqs:ReceiveMessage' , 'sqs:ChangeMessageVisibility' , 'sqs:DeleteMessage' , 'sqs:GetQueueUrl' ], "arn:%s:sqs:%s:%s:cfncluster-*" % (partition , region , accountid )),
5758 (['autoscaling:DescribeAutoScalingGroups' , 'autoscaling:TerminateInstanceInAutoScalingGroup' , 'autoscaling:SetDesiredCapacity' , 'autoscaling:DescribeTags' , 'autoScaling:UpdateAutoScalingGroup' ], "*" ),
5859 (['dynamodb:PutItem' , 'dynamodb:Query' , 'dynamodb:GetItem' , 'dynamodb:DeleteItem' , 'dynamodb:DescribeTable' ], "arn:%s:dynamodb:%s:%s:table/cfncluster-*" % (partition , region , accountid )),
59- (['cloudformation:DescribeStacks' ], "arn:%s:cloudformation:%s:%s:stack/cfncluster-%s/*" % (partition , region , accountid , cluster_name )),
6060 (['s3:GetObject' ], "arn:%s:s3:::%s-cfncluster/*" % (partition , region )),
6161 (['sqs:ListQueues' ], "*" ),
6262 (['logs:*' ], "arn:%s:logs:*:*:*" % partition )]
6363
64+ if cluster_name is not None :
65+ iam_policy ['cloudformation:DescribeStacks' ] = "arn:%s:cloudformation:%s:%s:stack/cfncluster-%s/*" % (partition , region , accountid , cluster_name )
66+
6467 for actions , resource_arn in iam_policy :
6568 response = iam .simulate_principal_policy (PolicySourceArn = arn , ActionNames = actions , ResourceArns = [resource_arn ])
6669 for decision in response .get ("EvaluationResults" ):
0 commit comments