Skip to content

Commit e24ee49

Browse files
JohnPrestonJohnPreston
authored
Refactoring permissions to JSON files (#151)
1 parent f723264 commit e24ee49

File tree

8 files changed

+145
-84
lines changed

8 files changed

+145
-84
lines changed

‎MANIFEST.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@ recursive-exclude * __pycache__
1010
recursive-exclude * *.py[co]
1111

1212
recursive-include docs *.rst conf.py Makefile make.bat *.jpg *.png *.gif
13+
recursive-include ecs_composex *.json

‎ecs_composex/dns/SYNTAX.rst‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,14 @@
11

2+
.. dns_reference_syntax:
3+
4+
x-dns
5+
======
6+
7+
.. code-block:: yaml
8+
9+
x-dns:
10+
PrivateNamespace:
11+
Name: mycluster.lan
12+
PublicNamespace:
13+
Name: lambda-my-aws.io
14+

‎ecs_composex/dynamodb/dynamodb_perms.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"RW": {
3+
"Action": [
4+
"dynamodb:BatchGet*",
5+
"dynamodb:DescribeStream",
6+
"dynamodb:DescribeTable",
7+
"dynamodb:Get*",
8+
"dynamodb:Query",
9+
"dynamodb:Scan",
10+
"dynamodb:BatchWrite*",
11+
"dynamodb:DeleteItem",
12+
"dynamodb:UpdateItem",
13+
"dynamodb:PutItem"
14+
],
15+
"Effect": "Allow"
16+
},
17+
"RO": {
18+
"Action": [
19+
"dynamodb:DescribeTable",
20+
"dynamodb:Query",
21+
"dynamodb:Scan"
22+
],
23+
"Effect": "Allow"
24+
},
25+
"PowerUser": {
26+
"NotAction": [
27+
"dynamodb:CreateTable",
28+
"dynamodb:DeleteTable",
29+
"dynamodb:DeleteBackup"
30+
]
31+
}
32+
}

‎ecs_composex/dynamodb/dynamodb_perms.py‎

Lines changed: 14 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -20,31 +20,17 @@
2020
based on pre-defined TABLE policies for consumers
2121
"""
2222

23-
ACCESS_TYPES = {
24-
"RW": {
25-
"Action": [
26-
"dynamodb:BatchGet*",
27-
"dynamodb:DescribeStream",
28-
"dynamodb:DescribeTable",
29-
"dynamodb:Get*",
30-
"dynamodb:Query",
31-
"dynamodb:Scan",
32-
"dynamodb:BatchWrite*",
33-
"dynamodb:DeleteItem",
34-
"dynamodb:UpdateItem",
35-
"dynamodb:PutItem",
36-
],
37-
"Effect": "Allow",
38-
},
39-
"RO": {
40-
"Action": ["dynamodb:DescribeTable", "dynamodb:Query", "dynamodb:Scan"],
41-
"Effect": "Allow",
42-
},
43-
"PowerUser": {
44-
"NotAction": [
45-
"dynamodb:CreateTable",
46-
"dynamodb:DeleteTable",
47-
"dynamodb:DeleteBackup",
48-
]
49-
},
50-
}
23+
from os import path
24+
from json import loads
25+
26+
27+
def get_access_types():
28+
with open(
29+
f"{path.abspath(path.dirname(__file__))}/dynamodb_perms.json",
30+
"r",
31+
encoding="utf-8-sig",
32+
) as perms_fd:
33+
return loads(perms_fd.read())
34+
35+
36+
ACCESS_TYPES = get_access_types()

‎ecs_composex/kms/kms_perms.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"SQS": {
3+
"Action": [
4+
"kms:GenerateDataKey",
5+
"kms:Decrypt"
6+
],
7+
"Effect": "Allow"
8+
},
9+
"DecryptOnly": {
10+
"Action": [
11+
"kms:Decrypt"
12+
],
13+
"Effect": "Allow"
14+
},
15+
"EncryptOnly": {
16+
"Action": [
17+
"kms:Encrypt",
18+
"kms:GenerateDataKey*",
19+
"kms:ReEncrypt*"
20+
],
21+
"Effect": "Allow"
22+
},
23+
"EncryptDecrypt": {
24+
"Action": [
25+
"kms:Encrypt",
26+
"kms:Decrypt",
27+
"kms:ReEncrypt*",
28+
"kms:GenerateDataKey*",
29+
"kms:CreateGrant",
30+
"kms:DescribeKey"
31+
],
32+
"Effect": "Allow"
33+
}
34+
}

‎ecs_composex/kms/kms_perms.py‎

Lines changed: 14 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -20,22 +20,17 @@
2020
based on pre-defined TABLE policies for consumers
2121
"""
2222

23-
ACCESS_TYPES = {
24-
"SQS": {"Action": ["kms:GenerateDataKey", "kms:Decrypt"], "Effect": "Allow"},
25-
"DecryptOnly": {"Action": ["kms:Decrypt"], "Effect": "Allow"},
26-
"EncryptOnly": {
27-
"Action": ["kms:Encrypt", "kms:GenerateDataKey*", "kms:ReEncrypt*"],
28-
"Effect": "Allow",
29-
},
30-
"EncryptDecrypt": {
31-
"Action": [
32-
"kms:Encrypt",
33-
"kms:Decrypt",
34-
"kms:ReEncrypt*",
35-
"kms:GenerateDataKey*",
36-
"kms:CreateGrant",
37-
"kms:DescribeKey",
38-
],
39-
"Effect": "Allow",
40-
},
41-
}
23+
from os import path
24+
from json import loads
25+
26+
27+
def get_access_types():
28+
with open(
29+
f"{path.abspath(path.dirname(__file__))}/kms_perms.json",
30+
"r",
31+
encoding="utf-8-sig",
32+
) as perms_fd:
33+
return loads(perms_fd.read())
34+
35+
36+
ACCESS_TYPES = get_access_types()

‎ecs_composex/sqs/sqs_perms.json‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"RWMessages": {
3+
"Sid": "RWAccessMessages",
4+
"NotAction": [
5+
"sqs:TagQueue",
6+
"sqs:RemovePermission",
7+
"sqs:AddPermission",
8+
"sqs:UntagQueue",
9+
"sqs:PurgeQueue",
10+
"sqs:DeleteQueue",
11+
"sqs:CreateQueue",
12+
"sqs:SetQueueAttributes"
13+
],
14+
"Effect": "Allow"
15+
},
16+
"Publish": {
17+
"Sid": "PublishMessages",
18+
"NotAction": [
19+
"sqs:SendMessage"
20+
],
21+
"Effect": "Allow"
22+
}
23+
}

‎ecs_composex/sqs/sqs_perms.py‎

Lines changed: 14 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -20,40 +20,17 @@
2020
based on pre-defined SQS policies for consumers
2121
"""
2222

23-
ACCESS_TYPES = {
24-
"RWMessages": {
25-
"NotAction": [
26-
"sqs:TagQueue",
27-
"sqs:RemovePermission",
28-
"sqs:AddPermission",
29-
"sqs:UntagQueue",
30-
"sqs:PurgeQueue",
31-
"sqs:DeleteQueue",
32-
"sqs:CreateQueue",
33-
"sqs:SetQueueAttributes",
34-
],
35-
"Effect": "Allow",
36-
},
37-
"RWPermissions": {
38-
"NotAction": [
39-
"sqs:RemovePermission",
40-
"sqs:AddPermission",
41-
"sqs:PurgeQueue",
42-
"sqs:SetQueueAttributes",
43-
],
44-
"Effect": "Allow",
45-
},
46-
"RO": {
47-
"NotAction": [
48-
"sqs:TagQueue",
49-
"sqs:RemovePermission",
50-
"sqs:AddPermission",
51-
"sqs:UntagQueue",
52-
"sqs:PurgeQueue",
53-
"sqs:Delete*",
54-
"sqs:Create*",
55-
"sqs:Set*",
56-
],
57-
"Effect": "Allow",
58-
},
59-
}
23+
from os import path
24+
from json import loads
25+
26+
27+
def get_access_types():
28+
with open(
29+
f"{path.abspath(path.dirname(__file__))}/sqs_perms.json",
30+
"r",
31+
encoding="utf-8-sig",
32+
) as perms_fd:
33+
return loads(perms_fd.read())
34+
35+
36+
ACCESS_TYPES = get_access_types()

0 commit comments

Comments
 (0)