fix: generate IAM roles when using AWS SDK integration with DynamoDB

Author: bayoudhi

lib/deploy/stepFunctions/compileIamRole.js

@@ -420,8 +420,12 @@ function getIamPermissions(taskStates) {
         return getSnsPermissions(this.serverless, state);
 
       case 'arn:aws:states:::dynamodb:updateItem':
+      case 'arn:aws:states:::aws-sdk:dynamodb:updateItem':
+      case 'arn:aws:states:::aws-sdk:dynamodb:updateItem.waitForTaskToken':
         return getDynamoDBPermissions('dynamodb:UpdateItem', state);
       case 'arn:aws:states:::dynamodb:putItem':
+      case 'arn:aws:states:::aws-sdk:dynamodb:putItem':
+      case 'arn:aws:states:::aws-sdk:dynamodb:putItem.waitForTaskToken':
         return getDynamoDBPermissions('dynamodb:PutItem', state);
       case 'arn:aws:states:::dynamodb:getItem':
         return getDynamoDBPermissions('dynamodb:GetItem', state);

lib/deploy/stepFunctions/compileIamRole.test.js

@@ -512,22 +512,22 @@ describe('#compileIamRole', () => {
       ],
     };
 
-    const genStateMachine = (id, tableName) => ({
+    const genStateMachine = (id, tableName, resources) => ({
       id,
       definition: {
         StartAt: 'A',
         States: {
           A: {
             Type: 'Task',
-            Resource: 'arn:aws:states:::dynamodb:updateItem',
+            Resource: resources[0],
             Parameters: {
               TableName: tableName,
             },
             Next: 'B',
           },
           B: {
             Type: 'Task',
-            Resource: 'arn:aws:states:::dynamodb:putItem',
+            Resource: resources[1],
             Parameters: {
               TableName: tableName,
             },
@@ -555,8 +555,10 @@ describe('#compileIamRole', () => {
 
     serverless.service.stepFunctions = {
       stateMachines: {
-        myStateMachine1: genStateMachine('StateMachine1', helloTable),
-        myStateMachine2: genStateMachine('StateMachine2', worldTable),
+        myStateMachine1: genStateMachine('StateMachine1', helloTable, ['arn:aws:states:::dynamodb:updateItem', 'arn:aws:states:::dynamodb:putItem']),
+        myStateMachine2: genStateMachine('StateMachine2', worldTable, ['arn:aws:states:::dynamodb:updateItem', 'arn:aws:states:::dynamodb:putItem']),
+        myStateMachine3: genStateMachine('StateMachine3', helloTable, ['arn:aws:states:::aws-sdk:dynamodb:updateItem', 'arn:aws:states:::aws-sdk:dynamodb:putItem']),
+        myStateMachine4: genStateMachine('StateMachine4', worldTable, ['arn:aws:states:::aws-sdk:dynamodb:updateItem.waitForTaskToken', 'arn:aws:states:::aws-sdk:dynamodb:putItem.waitForTaskToken']),
       },
     };
 
@@ -565,8 +567,10 @@ describe('#compileIamRole', () => {
       .provider.compiledCloudFormationTemplate.Resources;
     const policy1 = resources.StateMachine1Role.Properties.Policies[0];
     const policy2 = resources.StateMachine2Role.Properties.Policies[0];
+    const policy3 = resources.StateMachine3Role.Properties.Policies[0];
+    const policy4 = resources.StateMachine4Role.Properties.Policies[0];
 
-    [policy1, policy2].forEach((policy) => {
+    [policy1, policy2, policy3, policy4].forEach((policy) => {
       expect(policy.PolicyDocument.Statement[0].Action)
         .to.be.deep.equal([
           'dynamodb:UpdateItem',
@@ -580,6 +584,10 @@ describe('#compileIamRole', () => {
       .to.be.deep.equal([helloTableArn]);
     expect(policy2.PolicyDocument.Statement[0].Resource)
       .to.be.deep.equal([worldTableArn]);
+    expect(policy3.PolicyDocument.Statement[0].Resource)
+      .to.be.deep.equal([helloTableArn]);
+    expect(policy4.PolicyDocument.Statement[0].Resource)
+      .to.be.deep.equal([worldTableArn]);
   });
 
   it('should give dynamodb permission for table name imported from external stack', () => {
@@ -598,22 +606,22 @@ describe('#compileIamRole', () => {
       ],
     };
 
-    const genStateMachine = (id, tableName) => ({
+    const genStateMachine = (id, tableName, resources) => ({
       id,
       definition: {
         StartAt: 'A',
         States: {
           A: {
             Type: 'Task',
-            Resource: 'arn:aws:states:::dynamodb:updateItem',
+            Resource: resources[0],
             Parameters: {
               TableName: tableName,
             },
             Next: 'B',
           },
           B: {
             Type: 'Task',
-            Resource: 'arn:aws:states:::dynamodb:putItem',
+            Resource: resources[1],
             Parameters: {
               TableName: tableName,
             },
@@ -641,8 +649,10 @@ describe('#compileIamRole', () => {
 
     serverless.service.stepFunctions = {
       stateMachines: {
-        myStateMachine1: genStateMachine('StateMachine1', externalHelloTable),
-        myStateMachine2: genStateMachine('StateMachine2', externalWorldTable),
+        myStateMachine1: genStateMachine('StateMachine1', externalHelloTable, ['arn:aws:states:::dynamodb:updateItem', 'arn:aws:states:::dynamodb:putItem']),
+        myStateMachine2: genStateMachine('StateMachine2', externalWorldTable, ['arn:aws:states:::dynamodb:updateItem', 'arn:aws:states:::dynamodb:putItem']),
+        myStateMachine3: genStateMachine('StateMachine3', externalHelloTable, ['arn:aws:states:::aws-sdk:dynamodb:updateItem', 'arn:aws:states:::aws-sdk:dynamodb:putItem']),
+        myStateMachine4: genStateMachine('StateMachine4', externalWorldTable, ['arn:aws:states:::aws-sdk:dynamodb:updateItem.waitForTaskToken', 'arn:aws:states:::aws-sdk:dynamodb:putItem.waitForTaskToken']),
       },
     };
 
@@ -652,8 +662,10 @@ describe('#compileIamRole', () => {
       .provider.compiledCloudFormationTemplate.Resources;
     const policy1 = resources.StateMachine1Role.Properties.Policies[0];
     const policy2 = resources.StateMachine2Role.Properties.Policies[0];
+    const policy3 = resources.StateMachine3Role.Properties.Policies[0];
+    const policy4 = resources.StateMachine4Role.Properties.Policies[0];
 
-    [policy1, policy2].forEach((policy) => {
+    [policy1, policy2, policy3, policy4].forEach((policy) => {
       expect(policy.PolicyDocument.Statement[0].Action)
         .to.be.deep.equal([
           'dynamodb:UpdateItem',
@@ -667,6 +679,10 @@ describe('#compileIamRole', () => {
       .to.be.deep.equal([helloTableArn]);
     expect(policy2.PolicyDocument.Statement[0].Resource)
       .to.be.deep.equal([worldTableArn]);
+    expect(policy3.PolicyDocument.Statement[0].Resource)
+      .to.be.deep.equal([helloTableArn]);
+    expect(policy4.PolicyDocument.Statement[0].Resource)
+      .to.be.deep.equal([worldTableArn]);
   });
 
   it('should give dynamodb permission to * whenever TableName.$ is seen', () => {