serverless-iam-roles-per-function 正在参加 2021 年度 OSC 中国开源项目评选,请投票支持!
serverless-iam-roles-per-function 在 2021 年度 OSC 中国开源项目评选 中已获得 {{ projectVoteCount }} 票,请投票支持!
2021 年度 OSC 中国开源项目评选 正在火热进行中,快来投票支持你喜欢的开源项目!
2021 年度 OSC 中国开源项目评选 >>> 中场回顾
serverless-iam-roles-per-function 获得 2021 年度 OSC 中国开源项目评选「最佳人气项目」 !
授权协议 MIT License
开发语言 JavaScript
操作系统 跨平台
软件类型 开源软件
所属分类 云计算Serverless 系统
开源组织
地区 不详
投 递 者 首席测试
适用人群 未知
收录时间 2021-12-02

软件简介

Serverless IAM Roles Per Function Plugin

serverless npm package Build Status Coverage Status Dependencies Status Downloads

A Serverless plugin to easily define IAM roles per function via the use of iamRoleStatements at the function definition block.

Installation

npm install --save-dev serverless-iam-roles-per-function

Or if you want to try out the next upcoming version:

npm install --save-dev serverless-iam-roles-per-function@next

Add the plugin to serverless.yml:

plugins:
  - serverless-iam-roles-per-function

Note: Node 6.10 or higher runtime required.

Usage

Define iamRoleStatements definitions at the function level:

functions:
  func1:
    handler: handler.get
    iamRoleStatementsName: my-custom-role-name #optional custom role name setting instead of the default generated one
    iamRoleStatements:
      - Effect: "Allow"        
        Action:
          - dynamodb:GetItem        
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/mytable"
    ...
  func2:
    handler: handler.put    
    iamRoleStatements:
      - Effect: "Allow"        
        Action:
          - dynamodb:PutItem        
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/mytable"
    ...

The plugin will create a dedicated role for each function that has an iamRoleStatements definition. It will include the permissions for create and write to CloudWatch logs, stream events and if VPC is defined: AWSLambdaVPCAccessExecutionRole will be included (as is done when using iamRoleStatements at the provider level).

if iamRoleStatements are not defined at the function level default behavior is maintained and the function will receive the global iam role. It is possible to define an empty iamRoleStatements for a function and then the function will receive a dedicated role with only the permissions needed for CloudWatch and (if needed) stream events and VPC. Example of defining a function with empty iamRoleStatements and configured VPC. The function will receive a custom role with CloudWatch logs permissions and the policy AWSLambdaVPCAccessExecutionRole:

functions:
  func1:
    handler: handler.get    
    iamRoleStatements: []
    vpc:
      securityGroupIds:
        - sg-xxxxxx
      subnetIds:
        - subnet-xxxx
        - subnet-xxxxx

By default, function level iamRoleStatements override the provider level definition. It is also possible to inherit the provider level definition by specifying the option iamRoleStatementsInherit: true:

serverless >= v2.24.0

provider:
  name: aws
  iam:
    role:
      statements:
        - Effect: "Allow"
          Action:
            - xray:PutTelemetryRecords
            - xray:PutTraceSegments
          Resource: "*"
  ...
functions:
  func1:
    handler: handler.get
    iamRoleStatementsInherit: true
    iamRoleStatements:
      - Effect: "Allow"        
        Action:
          - dynamodb:GetItem        
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/mytable"

serverless < v2.24.0

provider:
  name: aws
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - xray:PutTelemetryRecords
        - xray:PutTraceSegments
      Resource: "*"
  ...
functions:
  func1:
    handler: handler.get
    iamRoleStatementsInherit: true
    iamRoleStatements:
      - Effect: "Allow"        
        Action:
          - dynamodb:GetItem        
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/mytable"

The generated role for func1 will contain both the statements defined at the provider level and the ones defined at the function level.

If you wish to change the default behavior to inherit instead of override it is possible to specify the following custom configuration:

custom:
  serverless-iam-roles-per-function:
    defaultInherit: true

Role Names

The plugin uses a naming convention for function roles which is similar to the naming convention used by the Serverless Framework. Function roles are named with the following convention:

<service-name>-<stage>-<function-name>-<region>-lambdaRole

AWS has a 64 character limit on role names. If the default naming exceeds 64 chars the plugin will remove the suffix: -lambdaRole to shorten the name. If it still exceeds 64 chars an error will be thrown containing a message of the form:

auto generated role name for function: ${functionName} is too long (over 64 chars).
Try setting a custom role name using the property: iamRoleStatementsName.

In this case you should set the role name using the property iamRoleStatementsName. For example:

functions:
  func1:
    handler: handler.get
    iamRoleStatementsName: my-custom-role-name 
    iamRoleStatements:
      - Effect: "Allow"        
        Action:
          - dynamodb:GetItem        
        Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/mytable"
    ...

PermissionsBoundary

Define iamPermissionsBoundary definitions at the function level:

functions:
  func1:
    handler: handler.get
    iamPermissionsBoundary: !Sub arn:aws:iam::xxxxx:policy/your_permissions_boundary_policy
    iamRoleStatementsName: my-custom-role-name 
    iamRoleStatements:
      - Effect: "Allow"        
        Action:
          - sqs:*        
        Resource: "*"
    ...

You can set permissionsBoundary for all roles with iamGlobalPermissionsBoundary in custom:

custom:
  serverless-iam-roles-per-function:
    iamGlobalPermissionsBoundary: !Sub arn:aws:iam::xxxx:policy/permissions-boundary-policy

For more information, see Permissions Boundaries.

Contributing

Contributions are welcome and appreciated.

  • Before opening a PR it is best to first open an issue. Describe in the issue what you want you plan to implement/fix. Based on the feedback in the issue, you should be able to plan how to implement your PR.
  • Once ready, open a PR to contribute your code.
  • To help updating the CHANGELOG.md file, we use standard-version. Make sure to use conventional commit messages as specified at: https://www.conventionalcommits.org/en/v1.0.0/.
  • Update the release notes at CHANGELOG.md and bump the version by running:
    npm run release 
    
  • Examine the CHANGELOG.md and update if still required.
  • Don't forget to commit the files modified by npm run release (we have the auto-commit option disabled by default).
  • Once the PR is approved and merged into master, travis-ci will automatically tag the version you created and deploy to npmjs under the next tag. You will see your version deployed at: https://www.npmjs.com/package/serverless-iam-roles-per-function?activeTab=versions.
  • Test your deployed version by installing with the next tag. For example:
    npm install --save-dev serverless-iam-roles-per-function@next
    

Publishing a Production Release (Maintainers)

Once a contributed PR (or multiple PRs) have been merged into master, there is need to publish a production release, after we are sure that the release is stable. Maintainers with commit access to the repository can publish a release by merging into the release branch. Steps to follow:

  • Verify that the current deployed pre-release version under the next tag in npmjs is working properly. Usually, it is best to allow the next version to gain traction a week or two before releasing. Also, if the version solves a specific reported issue, ask the community on the issue to test out the next version.

  • Make sure the version being used in master hasn't been released. This can happen if a PR was merged without bumping the version by running npm run release. If the version needs to be advanced, open a PR to advance the version as specified here.

  • Open a PR to merge into the release branch. Use as a base the release branch and compare the tag version to release. For example: Example PR

  • Once approved by another maintainer, merge the PR.

  • Make sure to check after the Travis CI build completes that the release has been published to the latest tag on nmpjs.

More Info

Introduction post: Serverless Framework: Defining Per-Function IAM Roles

Note: Serverless Framework provides support for defining custom IAM roles on a per function level through the use of the role property and creating CloudFormation resources, as documented here. This plugin doesn't support defining both the role property and iamRoleStatements at the function level.

展开阅读全文

代码

评论

点击引领话题📣
暂无内容
发表了博客
{{o.pubDate | formatDate}}

{{formatAllHtml(o.title)}}

{{parseInt(o.replyCount) | bigNumberTransform}}
{{parseInt(o.viewCount) | bigNumberTransform}}
没有更多内容
暂无内容
发表了问答
{{o.pubDate | formatDate}}

{{formatAllHtml(o.title)}}

{{parseInt(o.replyCount) | bigNumberTransform}}
{{parseInt(o.viewCount) | bigNumberTransform}}
没有更多内容
暂无内容
pathval 输入验证错误漏洞
原型污染
pathval是Chai.js团队的一个用于基于 String 字符串来检索和设置对象的 Npm 代码库 pathval 1.1.1之前版本存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。
CVE-2020-7751 MPS-2020-15246
2022-08-08 20:22
trim-newlines 安全漏洞
拒绝服务
trim-newlines是一个修改换行符的npm包。 trim-newlines 存在安全漏洞,该漏洞源于应用于Node.js在3.0.1与4.0.1版本及之前版本中.end()方法存在相关问题。
CVE-2021-33623 MPS-2021-7398
2022-08-08 20:22
nodejs 资源管理错误漏洞
拒绝服务
nodejs是是一个基于ChromeV8引擎的JavaScript运行环境通过对Chromev8引擎进行了封装以及使用事件驱动和非阻塞IO的应用让Javascript开发高性能的后台应用成为了可能。 nodejs-glob-parent 存在安全漏洞,该漏洞源于正则表达式拒绝服务。
CVE-2020-28469 MPS-2021-7827
2022-08-08 20:22
Moment.js 路径遍历漏洞
路径遍历
Moment.js 是一个 JavaScript 日期库。用于解析、验证、操作和格式化日期。 Moment.js 的 npm 版本中处理目录遍历序列时对于输入验证不严格导致可以构造特制的 HTTP 请求读取系统上的任意文件。 攻击者可利用该漏洞访问系统敏感文件。
CVE-2022-24785 MPS-2022-3752
2022-08-08 20:22
follow-redirects project信息暴露漏洞
信息暴露
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
CVE-2022-0536 MPS-2022-3636
2022-08-08 20:22
Amazon Aws-sdk-js 安全漏洞
Amazon Aws-sdk-js是美国亚马逊(Amazon)公司的一个基于Javascript用于为nodejs应用提供AWS服务支持的开发包。 Amazon Aws-sdk-js before 1.0.0-rc.9 存在安全漏洞,攻击者可利用该漏洞向应用程序提交恶意的INI文件,根据上下文进一步加以利用。
CVE-2020-28472 MPS-2021-0649
2022-08-08 20:22
jszip 安全漏洞
jszip是一个用于创建、读取和编辑.zip文件的JavaScript库。 jszip 3.7.0之前版本存在安全漏洞,该漏洞源于当创建一个新的zip文件,文件名设置为对象原型值时,将返回一个带有修改过的原型实例的对象。
CVE-2021-23413 MPS-2021-11050
2022-08-08 20:22
requests 代码注入漏洞
代码注入
Dan DeFelippi node-XMLHttpRequest是 (Dan DeFelippi)开源的一个应用软件。用于模拟浏览器XMLHttpRequest对象。 node-XMLHttpRequest before 1.7.0 存在代码注入漏洞,攻击者可利用该漏洞导致任意代码注入并运行。
CVE-2020-28502 MPS-2021-2418
2022-08-08 20:22
Npm Node-tar 后置链接漏洞
node-tar是一款用于文件压缩/解压缩的软件包。 Npm Node-tar 中存在后置链接漏洞,该漏洞源于产品未对特殊字符做有效验证。攻击者可通过该漏洞在其他路径创建恶意文件。
CVE-2021-37712 MPS-2021-28488
2022-08-08 20:22
Async 安全漏洞
原型污染
Async是英国Caolan McMahon个人开发者的一个实用模块。用于使用异步 JavaScript。 Async 3.2.1 及之前版本存在安全漏洞,该漏洞源于 mapValues() 方法。攻击者可通过 mapValues() 方法获取权限。
CVE-2021-43138 MPS-2021-34434
2022-08-08 20:22
github ws 资源管理错误漏洞
github ws是一个应用软件。一种易于使用,运行迅速且经过全面测试的WebSocket客户端和服务器实现的方法。 漏洞版本中“Sec-Websocket-Protocol”标头的一个特殊的值可以用来显著降低ws服务器的速度,从而导致拒绝服务漏洞。
CVE-2021-32640 MPS-2021-7109
2022-08-08 20:22
shelljs 安全漏洞
特权管理不恰当
shelljs是基于Node.js API 的 Unix shell 命令的可移植(Windows/Linux/OS X)实现。 shelljs存在安全漏洞,该漏洞源于不适当的权限管理,攻击者可利用该漏洞进行越权访问。
CVE-2022-0144 MPS-2022-0508
2022-08-08 20:22
Axios 代码问题漏洞
SSRF
Axios是一款基于Promise(异步编程的一种解决方案)的HTTP客户端。 Axios NPM package 0.21.0版本存在安全漏洞,攻击者可利用该漏洞能够通过提供一个URL绕过代理,该URL通过重定向响应一个受限制的主机或IP地址。
CVE-2020-28168 MPS-2020-16365
2022-08-08 20:22
Socketio Engineio 资源管理错误漏洞
拒绝服务
Socketio Engineio是Socketio社区的一个基于Javascript用于浏览器与设备进行双向通信的实时引擎。 Socketio socket.io-parser before 3.4.1 存在安全漏洞,攻击者可利用该漏洞通过大包导致拒绝服务(内存消耗)。
CVE-2020-36049 MPS-2021-0192
2022-08-08 20:22
stevemao trim-off-newlines 处理逻辑错误漏洞
trim-off-newlines是NPM的用于删除换行符。 stevemao trim-off-newlines存在处理逻辑错误漏洞,该漏洞源于所有版本的 trim-off-newlines 都容易通过字符串处理受到正则表达式拒绝服务 (ReDoS) 的攻击。
CVE-2021-23425 MPS-2021-17627
2022-08-08 20:22
node-tar 路径遍历漏洞
路径遍历
node-tar是一款用于文件压缩/解压缩的软件包。 npm node-tar 存在路径遍历漏洞,该漏洞源于4.4.18、5.0.10和6.1.9之前的npm包“tar”(又名node-tar)存在任意文件创建覆盖和任意代码执行漏洞。攻击者可利用该漏洞访问受限目录之外的位置。
CVE-2021-37713 MPS-2021-28489
2022-08-08 20:22
Axios 拒绝服务 漏洞
拒绝服务
Axios 是一个基于promise 网络请求库。 漏洞版本的axios 容易受到低效正则表达式复杂性的影响,从而引发拒绝服务 (ReDoS) 的攻击。
CVE-2021-3749 MPS-2021-30688
2022-08-08 20:22
simple-git-hooks存在未明漏洞
命令注入
simple-git-hooks是一个应用软件。一个简单的git钩子经理小型项目。simple-git-hooks 3.5.0之前版本存在安全漏洞,攻击者利用该漏洞进行命令注入。
CVE-2022-24066 MPS-2022-5073
2022-08-08 20:22
nanoid安全漏洞
不正确的类型转换
nanoid是用于 JavaScript 的小型、安全、URL 友好、唯一的字符串 ID 生成器。 nanoid安全中存在漏洞,该漏洞源于nanoid 容易通过 valueOf() 函数受到信息暴露的影响,该函数允许重现最后生成的 id。
CVE-2021-23566 MPS-2021-19605
2022-08-08 20:22
Npm Node-tar 后置链接漏洞
node-tar是一款用于文件压缩/解压缩的软件包。 Npm Node-tar 中存在后置链接漏洞,该漏洞源于产品未对特殊字符做有效验证。攻击者可通过该漏洞在其他路径创建恶意文件。
CVE-2021-37701 MPS-2021-28486
2022-08-08 20:22
没有更多内容
加载失败,请刷新页面
点击加载更多
加载中
下一页
0 评论
0 收藏
分享
OSCHINA
登录后可查看更多优质内容
返回顶部
顶部