Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: remove duplicate vpc execution permissions #3304

Conversation

wzyboy
Copy link
Contributor

@wzyboy wzyboy commented May 31, 2023

The PR removes duplicate VPC-related permissions from Lambda function execution role as they are already included in the Amazon-managed policy.

Permissions in arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:AssignPrivateIpAddresses",
                "ec2:UnassignPrivateIpAddresses"
            ],
            "Resource": "*"
        }
    ]
}

Permissions in custom JSON file:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DeleteNetworkInterface"
      ],
      "Resource": "*"
    }
  ]
}

As shown, the permissions in custom JSON file is a subset of the Amazon-managed policy. So it's not needed and can be safely removed.

@GuptaNavdeep1983
Copy link
Contributor

@wzyboy, Thanks for submitting this PR. Can you please confirm the tests done against this PR?

@wzyboy
Copy link
Contributor Author

wzyboy commented Jun 6, 2023

@GuptaNavdeep1983 I confirm that the Lambda runs fine without the duplicate permissions in our infra.

@GuptaNavdeep1983 GuptaNavdeep1983 self-requested a review June 7, 2023 17:59
@GuptaNavdeep1983
Copy link
Contributor

Steps taken to verify the PR:

  1. Executed the default example with lambda_subnet_ids and lambda_security_group_ids from the base vpc.
  2. Verified that scale-up lambda is able to reach the internet and perform the scaling.

@GuptaNavdeep1983 GuptaNavdeep1983 merged commit 0bebeef into philips-labs:main Jun 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants