授予对具有给定标签的 AWS Lambda 资源的访问权限

Question

我想授予一组用户对某些 Lambda 函数执行某些操作的访问权限。我的 Lambdas 已经被正确标记以允许这样做，例如：“department:hr”。我可以将它与 IAM 绑定在一起吗？

我已经看到有关允许将 ResourceTag\* 与值进行比较的条件的文档，但这些似乎在 Lambda 函数的可视化编辑器（不幸的是我依赖它）中不可用。

我想要这样的东西：

            "Effect": "Allow",
            "Action": [
                "lambda:ListFunctions",
                "lambda:ListVersionsByFunction",
                "lambda:GetLayerVersion",
                "lambda:GetEventSourceMapping",
                "lambda:GetFunction",
                "lambda:ListAliases",
                "lambda:GetAccountSettings",
                "lambda:GetFunctionConfiguration",
                "lambda:GetLayerVersionPolicy",
                "lambda:ListTags",
                "lambda:ListEventSourceMappings",
                "lambda:ListLayerVersions",
                "lambda:ListLayers",
                "lambda:GetAlias",
                "lambda:GetPolicy"
            ],
            "Resource": "*"
            "Condition": {
                "StringEquals": {
                    "lambda:ResourceTag/department": "hr"
                }

我无法在可视化编辑器中构建它，并且在我自己尝试时遇到语法错误。

Answer 1

我不认为lambda:ResourceTag/${TagKey} 是可用于任何 lambda 操作的上下文条件（参考：https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awslambda.html）。

话虽如此，上下文键的错误使用通常会静默失败。你能附上完整的声明吗？比如上面的sn-p中，就缺少了}这个条件。

Answer 2

如果您的 IAM 用户被标记为 department:hr，并且如果他们通过控制台承担以下 IAM 角色，他们应该能够访问被标记为 department:hr 的 lambda 函数。

HRDepartmentLambdaFunctionsAccessRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: "HRDepartmentLambdaFunctionsAccessRole"
    AssumeRolePolicyDocument:
      # Allow users in account X to perform operations on lambda functions
      Statement:
        - Effect: Allow
          Principal:
            AWS:
              - "AWS_ACCOUNT_NUMBER"
          Action:
            - sts:AssumeRole
          Condition:
            StringEquals:
              aws:PrincipalTag/department:
                - hr
    Path: /
    Policies:
      - PolicyName: AllowAccessToLambdaFunctionsInHRDepartment
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - lambda:ListFunctions
            - lambda:ListVersionsByFunction
            - lambda:GetLayerVersion
            - lambda:GetEventSourceMapping
            - lambda:GetFunction
            - lambda:ListAliases
            - lambda:GetAccountSettings
            - lambda:GetFunctionConfiguration
            - lambda:GetLayerVersionPolicy
            - lambda:ListTags
            - lambda:ListEventSourceMappings
            - lambda:ListLayerVersions
            - lambda:ListLayers
            - lambda:GetAlias
            - lambda:GetPolicy       
            Resource: '*'
            Condition:
              StringEquals:
                lambda:ResourceTag/department: 'hr'

参考：https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html