message: Fix S3 canary and canary permissions
diff: @@ -44,6 +44,7 @@ export class CanaryStack extends Stack {
  "lambda:CreateFunction",
  "lambda:DeleteFunction",
  "lambda:InvokeFunction",
  + "lambda:GetFunctionConfiguration",
  ],
  effect: Effect.ALLOW,
  // Only allow this for functions starting with prefix `canary-`
  @@ -66,7 +67,8 @@ export class CanaryStack extends Stack {
  removalPolicy: RemovalPolicy.DESTROY,
  });
  - // Allow the OIDC role to PutObject to the code bucket
  + // Allow the OIDC role to GetObject and PutObject to the code bucket
  + this.canaryCodeBucket.grantRead(this.awsSdkRustOidcRole.oidcRole);
  this.canaryCodeBucket.grantWrite(this.awsSdkRustOidcRole.oidcRole);
  // Create S3 bucket for the canaries to talk to
  @@ -110,5 +112,21 @@ export class CanaryStack extends Stack {
  resources: ["*"],
  }),
  );
  +
  + // Allow the OIDC role to pass the Lambda execution role to Lambda
  + this.awsSdkRustOidcRole.oidcRole.addToPolicy(
  + new PolicyStatement({
  + actions: ["iam:PassRole"],
  + effect: Effect.ALLOW,
  + // Security: only allow the Lambda execution role to be passed
  + resources: [this.lambdaExecutionRole.roleArn],
  + // Security: only allow the role to be passed to Lambda
  + conditions: {
  + StringEquals: {
  + "iam:PassedToService": "lambda.amazonaws.com",
  + },
  + },
  + }),
  + );
  }
  }
  