Skip to content

Commit

Permalink
fix(stepfunctions-tasks): run task permission is too broad (under fea…
Browse files Browse the repository at this point in the history 
…ture flag) (#30389)

Closes #30368. 

Doc: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.html#IAM_run_policies
  • Loading branch information
@msambol
msambol authored Jun 24, 2024
1 parent 1b1cff7 commit 8ebfade
Show file tree
Hide file tree
Showing 15 changed files with 1,157 additions and 1,107 deletions.
4 changes: 2 additions & 2 deletions ...ions-tasks/test/ecs/integ.ec2-run-task.js.snapshot/aws-sfn-tasks-ecs-run-task.assets.json
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

335 changes: 111 additions & 224 deletions ...ns-tasks/test/ecs/integ.ec2-run-task.js.snapshot/aws-sfn-tasks-ecs-run-task.template.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1070,231 +1070,118 @@
{
"Action": "ecs:RunTask",
"Effect": "Allow",
"Resource": [
{
"Fn::Join": [
"",
[
"arn:",
{
"Fn::Select": [
1,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
2,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
3,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
4,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
0,
{
"Fn::Split": [
"/",
{
"Fn::Select": [
5,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
}
]
}
]
},
"/",
{
"Fn::Select": [
1,
{
"Fn::Split": [
"/",
{
"Fn::Select": [
5,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
}
]
}
]
},
":*"
]
]
},
{
"Fn::Join": [
"",
[
"arn:",
{
"Fn::Select": [
1,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
2,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
3,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
4,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
0,
{
"Fn::Split": [
"/",
{
"Fn::Select": [
5,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
}
]
}
]
},
"/",
{
"Fn::Select": [
1,
{
"Fn::Split": [
"/",
{
"Fn::Select": [
5,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
}
]
}
]
}
]
"Resource": {
"Fn::Join": [
"",
[
"arn:",
{
"Fn::Select": [
1,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
2,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
3,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
4,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
},
":",
{
"Fn::Select": [
0,
{
"Fn::Split": [
"/",
{
"Fn::Select": [
5,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
}
]
}
]
},
"/",
{
"Fn::Select": [
1,
{
"Fn::Split": [
"/",
{
"Fn::Select": [
5,
{
"Fn::Split": [
":",
{
"Ref": "TaskDef54694570"
}
]
}
]
}
]
}
]
},
":*"
]
}
]
]
}
},
{
"Action": [
Expand Down
2 changes: 1 addition & 1 deletion ...-integ/test/aws-stepfunctions-tasks/test/ecs/integ.ec2-run-task.js.snapshot/manifest.json
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

0 comments on commit 8ebfade

Please sign in to comment.