feat: Generate DynamoDB resource policies #33

skuenzli · 2024-12-10T21:18:53Z

Add support for generating k9-style least privilege resource policies for DynamoDB resources.

const ddbResourcePolicyProps: k9.dynamodb.K9DynamoDBResourcePolicyProps = {
    k9DesiredAccess: new Array<k9.k9policy.IAccessSpec>(
        {
        ... desired access capabilities ...
        note: you should explicitly-allow your AWS Access Analyzer service-linked role to read-config
              so that you don't get an Error finding in AWS AA because it can't read the table metadata & policy
        });
const ddbResourcePolicy = k9.dynamodb.grantAccessViaResourcePolicy(ddbResourcePolicyProps);

const table = new dynamodb.TableV2(stack, 'k9-cdk-v2-int-test', {
  partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
  removalPolicy: cdk.RemovalPolicy.DESTROY,
  resourcePolicy: ddbResourcePolicy
});

…ce policy https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-iam-actions.html

… DDB

…ourcePolicyResult like S3 * Return AddToResourcePolicyResult[] instead of a (parallel, disconnected) PolicyDocument * Expand assertions for typical use of DynamoDB generator

…ttach the resource policy.

…cy and providing on construction This is what actually works. It's not clear to me: 1. why the TableV2 resourcePolicy property is not populated from constructor within a unit test 2. why adding resource policy statements works in unit tests but not at runtime

…nd produce findings.

Better communicates that the function does not have side effects. Aligns to name for side-effect free KMS policy generator.

joshlartz · 2024-12-12T03:30:27Z

resources/capability_summary.json

  "DynamoDB": {
    "administer-resource": [
      "dynamodb:CreateBackup",
-      "dynamodb:CreateGlobalTable",


These permissions for global tables very likely need to stay. The admin user should be allowed to make replicas.

These permissions changes were the result of:

updating to the full current list of DDB permissions

removing permissions not supported by DDB resource policy

Here are the administer-resource permissions from the full set of DDB perms that the DDB resource policy API rejected:

(administer-resource) One or more parameter values were invalid: Invalid policy document: The following action names are invalid: "dynamodb:UpdateGlobalTable", "dynamodb:UpdateGlobalTableSettings", "dynamodb:CreateTable", "dynamodb:UpdateGlobalTableVersion", "dynamodb:CreateGlobalTable", "dynamodb:RestoreTableFromBackup", "dynamodb:RestoreTableFromAwsBackup", "dynamodb:CreateTableReplica", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:ImportTable"

(I have similar output for read-config, read-data, and write-data if you are interested)

I can see why you logically you want an admin of a table to create a replica. However, I think that probably has to be granted from the Identity side. That aligns more with how Create[Resource] is generally not supported in resource policy. And in this specific case, I would think the principal CFn uses to create the table resources would be the one that needs permissions.

wdyt?

joshlartz · 2024-12-12T03:35:18Z

src/dynamodb.ts

+ * @param props specifying desired access
+ * @return a PolicyDocument that can be attached to DynamoDB resources
+ */
+export function makeResourcePolicy(props: K9DynamoDBResourcePolicyProps): PolicyDocument {


This works for our needs, but I was wondering if you still wanted to wrap this in a grantAccessViaResourcePolicy method to be consistent with s3.

joshlartz · 2024-12-12T03:35:49Z

src/dynamodb.ts

+  }
+
+  if (!canPrincipalsManageResources(accessSpecsByCapability)) {
+    throw Error('At least one principal must be able to administer and read-config for DynamoDB resources' +


Good check to have.

joshlartz · 2024-12-12T03:38:07Z

src/k9policy.ts

+}
+
+
+export function toPascalCase(input: string): string {


Did you hit a different naming restriction here that forced the casing?

Correct. DDB doesn't allow spaces nor hyphens.

joshlartz · 2024-12-12T03:39:05Z

test/k9.test.ts


 });

+describe('DynamoDBResourcePolicy', () => {


nit: break the tests into files to match src.

yes, might do that.

joshlartz · 2024-12-12T03:45:31Z

src/k9policy.ts

+ * @return true when at least one principal that can administer and read configuration exists
+ */
+export function canPrincipalsManageResources(accessSpecsByCapability: Map<AccessCapability, IAccessSpec>) {
+  console.log(`canPrincipalsManageResources eval'ing ${accessSpecsByCapability}`);


Console logging in a CDK library is a bit unusual. I'd advise debug here.

I forgot to mention that a while back. I swallow your console.log's from the KMS key policy generation to hide them. :)

sorry, that's not supposed to be there. will remove.

joshlartz · 2024-12-12T03:47:09Z

src/k9policy.ts

+        && (readConfigSpec?.allowPrincipalArns && readConfigSpec.allowPrincipalArns.length > 0)) {
+    const adminPrincipals = new Set<string>(adminSpec.allowPrincipalArns);
+    const readConfigPrincipals = new Set<string>(readConfigSpec.allowPrincipalArns);
+    const intersection = new Set(


Set has a native intersection method.

Unfortunately, I don't see an intersection method available on TypeScript 5.4.5 & Node 20.14.0 (what I dev on).

Looks like an upgrade might help here. However, it's tough when CDK supports all the way back to Node 14.15.0 and I know we have users on 16.x

joshlartz · 2024-12-12T03:48:31Z

test/__snapshots__/k9.test.ts.snap

 // Jest Snapshot v1, https://goo.gl/fbAQLP

+exports[`DynamoDBResourcePolicy Typical usage 1`] = `
+Object {


Jest 28 or 29 finally improved snapshot syntax and removed the type literals everywhere. Much easier on the eyes.

skuenzli · 2024-12-12T15:22:37Z

For future reference...

The DynamoDB permissions changes were the result of:

updating to the full current list of DDB permissions c.f. the k9 access capabilities API
removing permissions not supported by DDB resource policy

Here are from full set of DDB perms that the DDB resource policy API rejected:

One or more parameter values were invalid: Invalid policy document: The following action names are invalid:

(administer-resource): "dynamodb:UpdateGlobalTable", "dynamodb:UpdateGlobalTableSettings", "dynamodb:CreateTable", "dynamodb:UpdateGlobalTableVersion", "dynamodb:CreateGlobalTable", "dynamodb:RestoreTableFromBackup", "dynamodb:RestoreTableFromAwsBackup", "dynamodb:CreateTableReplica", "dynamodb:PurchaseReservedCapacityOfferings", "dynamodb:ImportTable"

(read-config): "dynamodb:ListContributorInsights", "dynamodb:ListGlobalTables", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:ListBackups", "dynamodb:DescribeLimits", "dynamodb:ListExports", "dynamodb:DescribeEndpoints", "dynamodb:DescribeReservedCapacity", "dynamodb:ListImports", "dynamodb:ListTables", "dynamodb:DescribeStream", "dynamodb:DescribeImport", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeBackup", "dynamodb:ListStreams"

(read-data): "dynamodb:GetRecords", "dynamodb:GetShardIterator"

(write-data): "dynamodb:RestoreTableFromAwsBackup", "dynamodb:StartAwsBackupJob", "dynamodb:CreateTableReplica", "dynamodb:ImportTable"

(delete-data): "dynamodb:DeleteBackup"

skuenzli added 4 commits December 9, 2024 17:02

(feat) Control access to DynamoDB resources using a resource policy.

54173ae

Optionally generate allow statements with statement ids in PascalCase.

231756c

Update DynamoDB capability summary with those supported by DDB resour…

72e5242

…ce policy https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-iam-actions.html

Extract canPrincipalsManageResources function to share across KMS and…

6b976a2

… DDB

skuenzli changed the title ~~(feat) Generate ddb resource policies~~ feat: Generate ddb resource policies Dec 10, 2024

skuenzli changed the title ~~feat: Generate ddb resource policies~~ feat: Generate DynamoDB resource policies Dec 10, 2024

skuenzli added 6 commits December 10, 2024 15:21

Revise DynamoDB resource policy generator to return array of AddToRes…

4f96035

…ourcePolicyResult like S3 * Return AddToResourcePolicyResult[] instead of a (parallel, disconnected) PolicyDocument * Expand assertions for typical use of DynamoDB generator

Add integration test. Note: creates the (global) table but does not a…

8f4e6b9

…ttach the resource policy.

Allow the AWS Access Analyzer service role to read the table config a…

a80ad6e

…nd produce findings.

Rename DynamoDB policy generation function to makeResourcePolicy

c631caf

Better communicates that the function does not have side effects. Aligns to name for side-effect free KMS policy generator.

Demonstrate use of DynamoDB policy generator in README

f1b8a25

joshlartz approved these changes Dec 12, 2024

View reviewed changes

skuenzli added 2 commits December 12, 2024 08:27

Remove unintended console logging

e54ce59

Document toPascalCase function.

716d347

skuenzli merged commit e356b7f into v2-main Dec 12, 2024
3 of 4 checks passed

skuenzli deleted the feat-generate-ddb-resource-policies branch December 30, 2024 13:28


		});

		describe('DynamoDBResourcePolicy', () => {

feat: Generate DynamoDB resource policies #33

feat: Generate DynamoDB resource policies #33

Uh oh!

Conversation

skuenzli commented Dec 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

skuenzli commented Dec 12, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

skuenzli commented Dec 10, 2024 •

edited

Loading