Skip to content

Commit 30e4154

Browse files
skuenzliskuenzli
committed
docs: Update example app to include SQS.
* add 'TestQueue' resource and policy to example app * generate SQS policy to file * integrate links into main README
1 parent 447f676 commit 30e4154

File tree

8 files changed

+614
-108
lines changed

8 files changed

+614
-108
lines changed

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,11 @@ S3 Bucket Policy:
139139
* [Templatized Bucket Policy](examples/generated.bucket-policy.json)
140140
* [BucketPolicy resource in CFn template](examples/K9Example.template.json)
141141

142+
SQS Queue Policy:
143+
144+
* [Templatized Queue Policy](examples/generated.queue-policy.json)
145+
* [TestQueuePolicy resource in CFn template](examples/K9Example.template.json)
146+
142147
KMS Key Policy:
143148

144149
* [Templatized Key Policy](examples/generated.key-policy.json)

‎examples/K9Example.template.json‎

Lines changed: 275 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,206 @@
454454
"aws:cdk:path": "K9Example/S3BucketPolicy/Resource"
455455
}
456456
},
457+
"TestQueue6F0069AA": {
458+
"Type": "AWS::SQS::Queue",
459+
"Properties": {
460+
"QueueName": "app-queue-with-k9-policy"
461+
},
462+
"UpdateReplacePolicy": "Delete",
463+
"DeletionPolicy": "Delete",
464+
"Metadata": {
465+
"aws:cdk:path": "K9Example/TestQueue/Resource"
466+
}
467+
},
468+
"TestQueuePolicyA65327BC": {
469+
"Type": "AWS::SQS::QueuePolicy",
470+
"Properties": {
471+
"PolicyDocument": {
472+
"Statement": [
473+
{
474+
"Action": [
475+
"sqs:AddPermission",
476+
"sqs:CancelMessageMoveTask",
477+
"sqs:CreateQueue",
478+
"sqs:DeleteQueue",
479+
"sqs:PurgeQueue",
480+
"sqs:RemovePermission",
481+
"sqs:SetQueueAttributes"
482+
],
483+
"Condition": {
484+
"ArnEquals": {
485+
"aws:PrincipalArn": [
486+
"arn:aws:iam::123456789012:user/ci",
487+
"arn:aws:iam::123456789012:user/person1"
488+
]
489+
}
490+
},
491+
"Effect": "Allow",
492+
"Principal": {
493+
"AWS": "*"
494+
},
495+
"Resource": "*",
496+
"Sid": "Allow Restricted administer-resource 1"
497+
},
498+
{
499+
"Action": [
500+
"sqs:StartMessageMoveTask",
501+
"sqs:TagQueue",
502+
"sqs:UntagQueue"
503+
],
504+
"Condition": {
505+
"ArnEquals": {
506+
"aws:PrincipalArn": [
507+
"arn:aws:iam::123456789012:user/ci",
508+
"arn:aws:iam::123456789012:user/person1"
509+
]
510+
}
511+
},
512+
"Effect": "Allow",
513+
"Principal": {
514+
"AWS": "*"
515+
},
516+
"Resource": "*",
517+
"Sid": "Allow Restricted administer-resource 2"
518+
},
519+
{
520+
"Action": [
521+
"sqs:GetQueueAttributes",
522+
"sqs:GetQueueUrl",
523+
"sqs:ListDeadLetterSourceQueues",
524+
"sqs:ListMessageMoveTasks",
525+
"sqs:ListQueues",
526+
"sqs:ListQueueTags"
527+
],
528+
"Condition": {
529+
"ArnEquals": {
530+
"aws:PrincipalArn": [
531+
"arn:aws:iam::123456789012:user/ci",
532+
"arn:aws:iam::123456789012:user/person1",
533+
"arn:aws:iam::123456789012:role/k9-auditor",
534+
"arn:aws:iam::123456789012:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer"
535+
]
536+
}
537+
},
538+
"Effect": "Allow",
539+
"Principal": {
540+
"AWS": "*"
541+
},
542+
"Resource": "*",
543+
"Sid": "Allow Restricted read-config"
544+
},
545+
{
546+
"Action": "sqs:ReceiveMessage",
547+
"Condition": {
548+
"ArnEquals": {
549+
"aws:PrincipalArn": [
550+
"arn:aws:iam::123456789012:role/app-backend",
551+
"arn:aws:iam::123456789012:role/customer-service"
552+
]
553+
}
554+
},
555+
"Effect": "Allow",
556+
"Principal": {
557+
"AWS": "*"
558+
},
559+
"Resource": "*",
560+
"Sid": "Allow Restricted read-data"
561+
},
562+
{
563+
"Action": [
564+
"sqs:ChangeMessageVisibility",
565+
"sqs:SendMessage"
566+
],
567+
"Condition": {
568+
"ArnEquals": {
569+
"aws:PrincipalArn": [
570+
"arn:aws:iam::123456789012:role/app-backend"
571+
]
572+
}
573+
},
574+
"Effect": "Allow",
575+
"Principal": {
576+
"AWS": "*"
577+
},
578+
"Resource": "*",
579+
"Sid": "Allow Restricted write-data"
580+
},
581+
{
582+
"Action": [
583+
"sqs:DeleteMessage",
584+
"sqs:DeleteQueue",
585+
"sqs:PurgeQueue"
586+
],
587+
"Condition": {
588+
"ArnEquals": {
589+
"aws:PrincipalArn": []
590+
}
591+
},
592+
"Effect": "Allow",
593+
"Principal": {
594+
"AWS": "*"
595+
},
596+
"Resource": "*",
597+
"Sid": "Allow Restricted delete-data"
598+
},
599+
{
600+
"Action": "sqs:*",
601+
"Condition": {
602+
"Bool": {
603+
"aws:PrincipalIsAWSService": [
604+
"false"
605+
]
606+
},
607+
"ArnNotEquals": {
608+
"aws:PrincipalArn": [
609+
{
610+
"Fn::Join": [
611+
"",
612+
[
613+
"arn:",
614+
{
615+
"Ref": "AWS::Partition"
616+
},
617+
":iam::",
618+
{
619+
"Ref": "AWS::AccountId"
620+
},
621+
":root"
622+
]
623+
]
624+
},
625+
"arn:aws:iam::123456789012:user/ci",
626+
"arn:aws:iam::123456789012:user/person1",
627+
"arn:aws:iam::123456789012:role/k9-auditor",
628+
"arn:aws:iam::123456789012:role/aws-service-role/access-analyzer.amazonaws.com/AWSServiceRoleForAccessAnalyzer",
629+
"arn:aws:iam::123456789012:role/app-backend",
630+
"arn:aws:iam::123456789012:role/customer-service"
631+
]
632+
}
633+
},
634+
"Effect": "Deny",
635+
"Principal": {
636+
"AWS": [
637+
"*",
638+
"*"
639+
]
640+
},
641+
"Resource": "*",
642+
"Sid": "DenyEveryoneElse"
643+
}
644+
],
645+
"Version": "2012-10-17"
646+
},
647+
"Queues": [
648+
{
649+
"Ref": "TestQueue6F0069AA"
650+
}
651+
]
652+
},
653+
"Metadata": {
654+
"aws:cdk:path": "K9Example/TestQueue/Policy/Resource"
655+
}
656+
},
457657
"TestKey4CACAF33": {
458658
"Type": "AWS::KMS::Key",
459659
"Properties": {
@@ -815,7 +1015,7 @@
8151015
"CDKMetadata": {
8161016
"Type": "AWS::CDK::Metadata",
8171017
"Properties": {
818-
"Analytics": "v2:deflate64:H4sIAAAAAAAA/0WJyw6CMBBFv4V9GQGJHyALF2wIGremjzEZWtqEFglp+u8GMHF1zj23grK+QJHxxedS6dyQgHgPXGrGF/+K/gzxOkuNgTVv+7MDnTMk138+dmJ69BBb3J8W18TUavnolID44MLgs9qem3GCmz2ktIUevZsniZs3zioK5Gxi1imEwZ8+VQFlDUU2eKJ8mm2gEaE/+AVlye6ExgAAAA=="
1018+
"Analytics": "v2:deflate64:H4sIAAAAAAAA/02NwQ6CMBBEv8V7WQGN3uXggYui8WpKuyalpY0slZCm/24AE7zszLzJZnLIjgdIN3ygREidGFVDuPVcaMYHegbaQTh5obFnxcv+3CIXZ5QYV7zkyOhNEK4ePU7dYua7PvzFyHRLEEqcixLHyORoeetkDeHOa4OPfGrOxtXczCDGCVRIzndiHimclapXzkZmnURoaPvJU8j2kG4aUirpvO1Vi1At+gWhj+v29gAAAA=="
8191019
},
8201020
"Metadata": {
8211021
"aws:cdk:path": "K9Example/CDKMetadata/Default"
@@ -860,6 +1060,14 @@
8601060
"ap-northeast-2"
8611061
]
8621062
},
1063+
{
1064+
"Fn::Equals": [
1065+
{
1066+
"Ref": "AWS::Region"
1067+
},
1068+
"ap-northeast-3"
1069+
]
1070+
},
8631071
{
8641072
"Fn::Equals": [
8651073
{
@@ -868,6 +1076,14 @@
8681076
"ap-south-1"
8691077
]
8701078
},
1079+
{
1080+
"Fn::Equals": [
1081+
{
1082+
"Ref": "AWS::Region"
1083+
},
1084+
"ap-south-2"
1085+
]
1086+
},
8711087
{
8721088
"Fn::Equals": [
8731089
{
@@ -884,6 +1100,26 @@
8841100
"ap-southeast-2"
8851101
]
8861102
},
1103+
{
1104+
"Fn::Equals": [
1105+
{
1106+
"Ref": "AWS::Region"
1107+
},
1108+
"ap-southeast-3"
1109+
]
1110+
}
1111+
]
1112+
},
1113+
{
1114+
"Fn::Or": [
1115+
{
1116+
"Fn::Equals": [
1117+
{
1118+
"Ref": "AWS::Region"
1119+
},
1120+
"ap-southeast-4"
1121+
]
1122+
},
8871123
{
8881124
"Fn::Equals": [
8891125
{
@@ -892,6 +1128,14 @@
8921128
"ca-central-1"
8931129
]
8941130
},
1131+
{
1132+
"Fn::Equals": [
1133+
{
1134+
"Ref": "AWS::Region"
1135+
},
1136+
"ca-west-1"
1137+
]
1138+
},
8951139
{
8961140
"Fn::Equals": [
8971141
{
@@ -907,11 +1151,7 @@
9071151
},
9081152
"cn-northwest-1"
9091153
]
910-
}
911-
]
912-
},
913-
{
914-
"Fn::Or": [
1154+
},
9151155
{
9161156
"Fn::Equals": [
9171157
{
@@ -920,6 +1160,14 @@
9201160
"eu-central-1"
9211161
]
9221162
},
1163+
{
1164+
"Fn::Equals": [
1165+
{
1166+
"Ref": "AWS::Region"
1167+
},
1168+
"eu-central-2"
1169+
]
1170+
},
9231171
{
9241172
"Fn::Equals": [
9251173
{
@@ -936,6 +1184,18 @@
9361184
"eu-south-1"
9371185
]
9381186
},
1187+
{
1188+
"Fn::Equals": [
1189+
{
1190+
"Ref": "AWS::Region"
1191+
},
1192+
"eu-south-2"
1193+
]
1194+
}
1195+
]
1196+
},
1197+
{
1198+
"Fn::Or": [
9391199
{
9401200
"Fn::Equals": [
9411201
{
@@ -991,11 +1251,7 @@
9911251
},
9921252
"sa-east-1"
9931253
]
994-
}
995-
]
996-
},
997-
{
998-
"Fn::Or": [
1254+
},
9991255
{
10001256
"Fn::Equals": [
10011257
{
@@ -1019,16 +1275,16 @@
10191275
},
10201276
"us-west-1"
10211277
]
1022-
},
1023-
{
1024-
"Fn::Equals": [
1025-
{
1026-
"Ref": "AWS::Region"
1027-
},
1028-
"us-west-2"
1029-
]
10301278
}
10311279
]
1280+
},
1281+
{
1282+
"Fn::Equals": [
1283+
{
1284+
"Ref": "AWS::Region"
1285+
},
1286+
"us-west-2"
1287+
]
10321288
}
10331289
]
10341290
}

0 commit comments

Comments
 (0)