CODEWITHSUNDEEP
pythonamazon-web-servicesamazon-iamaws-cdk
Jorge Ivansevick
Jorge Ivansevick

Reputation: 153

IAM Role Conditions in AWS CDK Python

I am creating a new IAM Role custom policy, but it do a rollback with the reason: MalformedPolicyDocument


myrole = iam.Role(self,config['CUSTOM_POLICY']['ROLE'],
    assumed_by=iam.ServicePrincipal('ec2.amazonaws.com'),
    role_name=config['CUSTOM_POLICY']['NAME']
)
myrole.add_to_policy(
    iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        resources=['arn:aws:s3:::MyBucket/*'],
        actions=[
            's3:CreateBucket',
            's3:GetObject',
            's3:ListBucket',
            's3:PutObject'
        ],
        conditions=[
            {
                'aws:SourceIp':'192.10.10.10/32'
            }
        ]
    )
)

If I delete the conditions it works, what is the correct syntax considering conditionals?

Upvotes: 3

Views: 8946

Answers (2)

Amer Elhabbash
Amer Elhabbash

Reputation: 520

The accepted answer did not work for me, this is how it worked for python

iam.PolicyStatement(sid="AllowSendCommand",
                        effect=iam.Effect.ALLOW,
                        actions=["ssm:SendCommand"],
                        resources=["arn:aws:ec2:" + Aws.REGION + ":" + Aws.ACCOUNT_ID + ":instance/*",
                                  "arn:aws:ssm:" + Aws.REGION + "::document/AWS-RunPowerShellScript"],
                        conditions={"StringEquals": 
                                     {"aws:ResourceTag/Name": [bastion_host_stack_name + "/BastionHostLaunchTemplate"]}})

Upvotes: 5

maafk
maafk

Reputation: 6876

It looks like you're leaving out the condition operator. Are you looking for something like:

conditions=[
    {
        "NotIpAddress": {
            "aws:SourceIp": ["192.10.10.10/32"]
        }
        
    }
]

Upvotes: 5

Related Questions