dynamo permissions

Prod in path
wbornor · Jan 1, 2024 · 8735b87 · 8735b87
1 parent ddf6a4b
commit 8735b87
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 2 deletions.
diff --git a/app/main.py b/app/main.py
@@ -33,7 +33,7 @@ def my_schema():
         "version": DOCS_VERSION,
         "description": "REST Interface for Splaysh",
         "servers": [
-            {"url": "https://merymlbcs3.execute-api.us-east-1.amazonaws.com/Prod"}
+            {"url": "https://merymlbcs3.execute-api.us-east-1.amazonaws.com/Prod", "description": "Dev environment"}
         ],
         "license": {
             "name": "Apache 2.0",

diff --git a/app/routers/items.py b/app/routers/items.py
@@ -10,7 +10,7 @@ def __init__(self, items_domain: ItemsDomain) -> None:
 
     @property
     def router(self):
-        api_router = APIRouter(prefix='/items', tags=['items'])
+        api_router = APIRouter(prefix='/Prod/items', tags=['items'])
 
         @api_router.get('/', summary='List the latest items')
         def index_route() -> list[ItemModel]:

diff --git a/template.yaml b/template.yaml
@@ -20,6 +20,21 @@ Resources:
             Method: ANY
       FunctionUrlConfig:
         AuthType: NONE
+      Policies:
+        - Statement:
+            - Effect: Allow
+              Action:
+                - logs:CreateLogGroup
+                - logs:CreateLogStream
+                - logs:PutLogEvents
+              Resource: '*'
+        - Statement:
+            - Effect: Allow
+              Action:
+                - dynamodb:Query
+                - dynamodb:Scan
+                - dynamodb:GetItem
+              Resource: 'splayshdb.*.items'
 
 Outputs:
   # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function