feat: restrict PutEvents permissions

aws-samples · May 26, 2021 · 6f43051 · 6f43051
1 parent 0164f61
commit 6f43051
Show file tree

Hide file tree

Showing 10 changed files with 40 additions and 5 deletions.
diff --git a/delivery/metadata.yaml b/delivery/metadata.yaml
@@ -3,6 +3,7 @@ dependencies:
   - orders
   - platform
 parameters:
+  EventBusArn: /ecommerce/{Environment}/platform/event-bus/arn
   EventBusName: /ecommerce/{Environment}/platform/event-bus/name
   OrdersApiUrl: /ecommerce/{Environment}/orders/api/url
   OrdersApiArn: /ecommerce/{Environment}/orders/api/arn
diff --git a/delivery/template.yaml b/delivery/template.yaml
@@ -14,6 +14,9 @@ Parameters:
     Type: Number
     Default: 30
     Description: CloudWatch Logs retention period for Lambda functions
+  EventBusArn:
+    Type: AWS::SSM::Parameter::Value<String>
+    Description: EventBridge Event Bus ARN
   EventBusName:
     Type: AWS::SSM::Parameter::Value<String>
     Description: EventBridge Event Bus Name
@@ -141,7 +144,10 @@ Resources:
             - Effect: Allow
               Action:
                 - events:PutEvents
-              Resource: "*"
+              Resource: !Ref EventBusArn
+              Condition:
+                StringEquals:
+                  events:source: "ecommerce.delivery"
             - Effect: Allow
               Action:
                 - sqs:SendMessage

diff --git a/orders/metadata.yaml b/orders/metadata.yaml
@@ -6,6 +6,7 @@ dependencies:
 parameters:
   DeliveryApiArn: /ecommerce/{Environment}/delivery-pricing/api/arn
   DeliveryApiUrl: /ecommerce/{Environment}/delivery-pricing/api/url
+  EventBusArn: /ecommerce/{Environment}/platform/event-bus/arn
   EventBusName: /ecommerce/{Environment}/platform/event-bus/name
   PaymentApiArn: /ecommerce/{Environment}/payment/api/arn
   PaymentApiUrl: /ecommerce/{Environment}/payment/api/url

diff --git a/orders/template.yaml b/orders/template.yaml
@@ -20,6 +20,9 @@ Parameters:
   DeliveryApiArn:
     Type: AWS::SSM::Parameter::Value<String>
     Description: Delivery API Gateway ARN
+  EventBusArn:
+    Type: AWS::SSM::Parameter::Value<String>
+    Description: EventBridge Event Bus ARN
   EventBusName:
     Type: AWS::SSM::Parameter::Value<String>
     Description: EventBridge Event Bus Name
@@ -184,7 +187,10 @@ Resources:
             - Effect: Allow
               Action:
                 - events:PutEvents
-              Resource: "*"
+              Resource: !Ref EventBusArn
+              Condition:
+                StringEquals:
+                  events:source: "ecommerce.orders"
             - Effect: Allow
               Action:
                 - sqs:SendMessage

diff --git a/products/metadata.yaml b/products/metadata.yaml
@@ -6,4 +6,5 @@ permissions:
     api:
       /validate: [post]
 parameters:
+  EventBusArn: /ecommerce/{Environment}/platform/event-bus/arn
   EventBusName: /ecommerce/{Environment}/platform/event-bus/name
diff --git a/products/template.yaml b/products/template.yaml
@@ -14,6 +14,9 @@ Parameters:
     Type: Number
     Default: 30
     Description: CloudWatch Logs retention period for Lambda functions
+  EventBusArn:
+    Type: AWS::SSM::Parameter::Value<String>
+    Description: EventBridge Event Bus ARN
   EventBusName:
     Type: AWS::SSM::Parameter::Value<String>
     Description: EventBridge Event Bus Name
@@ -118,7 +121,10 @@ Resources:
             - Effect: Allow
               Action:
                 - events:PutEvents
-              Resource: "*"
+              Resource: !Ref EventBusArn
+              Condition:
+                StringEquals:
+                  events:source: "ecommerce.products"
             - Effect: Allow
               Action:
                 - sqs:SendMessage

diff --git a/users/metadata.yaml b/users/metadata.yaml
@@ -2,4 +2,5 @@ name: users
 dependencies:
   - platform
 parameters:
+  EventBusArn: /ecommerce/{Environment}/platform/event-bus/arn
   EventBusName: /ecommerce/{Environment}/platform/event-bus/name
diff --git a/users/template.yaml b/users/template.yaml
@@ -14,6 +14,9 @@ Parameters:
     Type: Number
     Default: 30
     Description: CloudWatch Logs retention period for Lambda functions
+  EventBusArn:
+    Type: AWS::SSM::Parameter::Value<String>
+    Description: EventBridge Event Bus ARN
   EventBusName:
     Type: AWS::SSM::Parameter::Value<String>
     Description: EventBridge Event Bus Name
@@ -86,7 +89,10 @@ Resources:
             - Effect: Allow
               Action:
                 - events:PutEvents
-              Resource: "*"
+              Resource: !Ref EventBusArn
+              Condition:
+                StringEquals:
+                  events:source: "ecommerce.users"
 
   SignUpLogGroup:
     Type: AWS::Logs::LogGroup

diff --git a/warehouse/metadata.yaml b/warehouse/metadata.yaml
@@ -3,4 +3,5 @@ dependencies:
   - platform
   - users
 parameters:
+  EventBusArn: /ecommerce/{Environment}/platform/event-bus/arn
   EventBusName: /ecommerce/{Environment}/platform/event-bus/name
diff --git a/warehouse/template.yaml b/warehouse/template.yaml
@@ -14,6 +14,9 @@ Parameters:
     Type: Number
     Default: 30
     Description: CloudWatch Logs retention period for Lambda functions
+  EventBusArn:
+    Type: AWS::SSM::Parameter::Value<String>
+    Description: EventBridge Event Bus ARN
   EventBusName:
     Type: AWS::SSM::Parameter::Value<String>
     Description: EventBridge Event Bus Name
@@ -154,7 +157,10 @@ Resources:
             - Effect: Allow
               Action:
                 - events:PutEvents
-              Resource: "*"
+              Resource: !Ref EventBusArn
+              Condition:
+                StringEquals:
+                  events:source: "ecommerce.warehouse"
             - Effect: Allow
               Action:
                 - dynamodb:Query