Restrict resource for iam:PassRole to be scoped to createJobRequest.Role

aws · May 23, 2024 · 562cedc · 562cedc
1 parent aa1b58d
commit 562cedc
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 12 deletions.
diff --git a/.../test/integ.create-job.js.snapshot/aws-cdk-mediaconvert-create-job-test-stack.assets.json b/.../test/integ.create-job.js.snapshot/aws-cdk-mediaconvert-create-job-test-stack.assets.json
diff --git a/...est/integ.create-job.js.snapshot/aws-cdk-mediaconvert-create-job-test-stack.template.json b/...est/integ.create-job.js.snapshot/aws-cdk-mediaconvert-create-job-test-stack.template.json
@@ -23,10 +23,17 @@
     "PolicyDocument": {
      "Statement": [
       {
-       "Action": [
-        "iam:PassRole",
-        "mediaconvert:CreateJob"
-       ],
+       "Action": "iam:PassRole",
+       "Condition": {
+        "StringLike": {
+         "iam:PassedToService": "mediaconvert.amazonaws.com"
+        }
+       },
+       "Effect": "Allow",
+       "Resource": "arn:aws:iam::123456789012:role/MediaConvertRole"
+      },
+      {
+       "Action": "mediaconvert:CreateJob",
        "Effect": "Allow",
        "Resource": "*"
       }

diff --git a/...aws-stepfunctions-tasks/test/mediaconvert/test/integ.create-job.js.snapshot/manifest.json b/...aws-stepfunctions-tasks/test/mediaconvert/test/integ.create-job.js.snapshot/manifest.json
diff --git a/...est/aws-stepfunctions-tasks/test/mediaconvert/test/integ.create-job.js.snapshot/tree.json b/...est/aws-stepfunctions-tasks/test/mediaconvert/test/integ.create-job.js.snapshot/tree.json
diff --git a/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/mediaconvert/create-job.ts b/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/mediaconvert/create-job.ts
@@ -59,7 +59,10 @@ export class MediaConvertCreateJob extends sfn.TaskStateBase {
     const policyStatements = [
       new iam.PolicyStatement({
         actions: ['iam:PassRole'],
-        resources: ['*'],
+        resources: [this.props.createJobRequest.Role],
+        conditions: {
+          StringLike: { 'iam:PassedToService': 'mediaconvert.amazonaws.com' },
+        },
       }),
       new iam.PolicyStatement({
         actions: ['mediaconvert:CreateJob'],