[Migrated] Improve README.md instructions for using custom IAM policy via attach_policy

[jneves]

Originally from: Miserlou/Zappa#2079 by jdmwood

The README at https://github.com/Miserlou/Zappa#custom-aws-iam-roles-and-policies-for-execution talks about using manage_roles: false to manually set a role for custom permissions.

This along with Miserlou/Zappa#244 led me down a rabbit hole.

However, if all you want to do is restrict the permissions of the Lambda itself, it seems that the partially documented attach_policy is a much better option because this keeps the policy managed by Zappa (no need for manual steps).

Might be worth adding this as an option to the "IAM Roles and polices" section because surely this will solve 95% of requirements for users?

E.g. here is my settings.json:

{
    "build": {
        "app_function": "webapp.app",
        "aws_region": "eu-west-1",
        "profile_name": "test",
        "project_name": "deploy",
        "runtime": "python3.7",
        "s3_bucket": "xxxx-zappa-test",
        "attach_policy": "aws_attach_policy.json"
    }
}

And my aws_attach_policy.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:*"
      ],
      "Resource": "arn:aws:logs:eu-west-1:*:log-group:/aws/lambda/deploy-build:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "arn:aws:lambda:eu-west-1:*:function:deploy-build"
      ]
    }
  ]
}

(In my case I didn't need much permissions, but you get the idea).

[souravjamwal77]

Hi @jneves are there any updates on this?

[github-actions]

Hi there! Unfortunately, this Issue has not seen any activity for at least 90 days. If the Issue is still relevant to the latest version of Zappa, please comment within the next 10 days if you wish to keep it open. Otherwise, it will be automatically closed.

[github-actions]

Hi there! Unfortunately, this Issue was automatically closed as it had not seen any activity in at least 100 days. If the Issue is still relevant to the latest version of Zappa, please open a new Issue.