Skip to content

Commit

Permalink
fix(iam): IAM Policies are too large to deploy (#19114)
Browse files Browse the repository at this point in the history 
The policies we generate sometimes have a lot of duplication between
statements. This duplication can lead to the policy going over the size
limit an IAM policy (either 2k, 6k or 10k bytes, depending on the resource
type).

This change combines multiple statements together, as long as it
doesn't change the meaning of the final policy.

Because doing so for all existing stacks will probably provoke minor
heart attacks in operators everywhere, the new behavior is gated
behind a feature flag. It can be retroactively switched on by
people currently being bit by the size issues:

```
@aws-cdk/aws-iam:minimizePolicies
```

We will merge 2 statements if their effects are the same, and they are otherwise exactly the same apart from their `Action`, `Resource` or `Principal` declarations. We will not merge `NotXxx` statements, because doing so will change the meaning of the statement (`not A or not B ≠ not (A or B)`). There may be multiple possible merges that apply and we are not guaranteed to find the smallest merging, nor do we take effort to find all possible merges and do simplifications like `*`-subsumption. This is a starting point that should help out in the common case.

Fixes #18774, fixes #16350, fixes #18457, fixes #18564, fixes #19276.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
@rix0rrr
rix0rrr authored Mar 18, 2022
1 parent 2f01bf0 commit 3a4fe33
Show file tree
Hide file tree
Showing 244 changed files with 6,180 additions and 7,166 deletions.
258 changes: 93 additions & 165 deletions ...es/@aws-cdk-containers/ecs-service-extensions/test/integ.all-service-addons.expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -941,8 +941,8 @@
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": {
Expand Down Expand Up @@ -972,30 +972,12 @@
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"nametaskdefinitionenvoyLogGroup258B673B",
"Arn"
]
}
},
{
"Action": [
"ecr:GetAuthorizationToken",
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetAuthorizationToken",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": "*"
Expand All @@ -1006,38 +988,32 @@
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"nametaskdefinitionfirelensLogGroup80DDA60F",
"Arn"
]
}
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"nametaskdefinitionxrayLogGroup4AF4CA37",
"Arn"
]
}
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"nametaskdefinitioncloudwatchagentLogGroup78DDC685",
"Arn"
]
}
"Resource": [
{
"Fn::GetAtt": [
"nametaskdefinitioncloudwatchagentLogGroup78DDC685",
"Arn"
]
},
{
"Fn::GetAtt": [
"nametaskdefinitionenvoyLogGroup258B673B",
"Arn"
]
},
{
"Fn::GetAtt": [
"nametaskdefinitionfirelensLogGroup80DDA60F",
"Arn"
]
},
{
"Fn::GetAtt": [
"nametaskdefinitionxrayLogGroup4AF4CA37",
"Arn"
]
}
]
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -1814,8 +1790,8 @@
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": {
Expand Down Expand Up @@ -1845,30 +1821,12 @@
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetingtaskdefinitionenvoyLogGroup6556AC35",
"Arn"
]
}
},
{
"Action": [
"ecr:GetAuthorizationToken",
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetAuthorizationToken",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": "*"
Expand All @@ -1879,38 +1837,32 @@
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetingtaskdefinitionfirelensLogGroupD7A398A7",
"Arn"
]
}
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetingtaskdefinitionxrayLogGroupD25C072D",
"Arn"
]
}
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetingtaskdefinitioncloudwatchagentLogGroupCEF72742",
"Arn"
]
}
"Resource": [
{
"Fn::GetAtt": [
"greetingtaskdefinitioncloudwatchagentLogGroupCEF72742",
"Arn"
]
},
{
"Fn::GetAtt": [
"greetingtaskdefinitionenvoyLogGroup6556AC35",
"Arn"
]
},
{
"Fn::GetAtt": [
"greetingtaskdefinitionfirelensLogGroupD7A398A7",
"Arn"
]
},
{
"Fn::GetAtt": [
"greetingtaskdefinitionxrayLogGroupD25C072D",
"Arn"
]
}
]
}
],
"Version": "2012-10-17"
Expand Down Expand Up @@ -2810,8 +2762,8 @@
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": {
Expand Down Expand Up @@ -2841,30 +2793,12 @@
]
}
},
{
"Action": "ecr:GetAuthorizationToken",
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetertaskdefinitionenvoyLogGroup6E10B93E",
"Arn"
]
}
},
{
"Action": [
"ecr:GetAuthorizationToken",
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
"ecr:BatchGetImage",
"ecr:GetAuthorizationToken",
"ecr:GetDownloadUrlForLayer"
],
"Effect": "Allow",
"Resource": "*"
Expand All @@ -2875,38 +2809,32 @@
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetertaskdefinitionfirelensLogGroupD5BAAC35",
"Arn"
]
}
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetertaskdefinitionxrayLogGroupBC1558B6",
"Arn"
]
}
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": {
"Fn::GetAtt": [
"greetertaskdefinitioncloudwatchagentLogGroupE7EAF327",
"Arn"
]
}
"Resource": [
{
"Fn::GetAtt": [
"greetertaskdefinitioncloudwatchagentLogGroupE7EAF327",
"Arn"
]
},
{
"Fn::GetAtt": [
"greetertaskdefinitionenvoyLogGroup6E10B93E",
"Arn"
]
},
{
"Fn::GetAtt": [
"greetertaskdefinitionfirelensLogGroupD5BAAC35",
"Arn"
]
},
{
"Fn::GetAtt": [
"greetertaskdefinitionxrayLogGroupBC1558B6",
"Arn"
]
}
]
}
],
"Version": "2012-10-17"
Expand Down
Loading

0 comments on commit 3a4fe33

Please sign in to comment.