Question

我正在尝试使用AWS CDK通过自定义策略创建具有最小权限的用户，但是我仍然坚持标记该用户并创建其访问密钥。

下面是我的代码：

public class Sample extends App {
    public static void main(final String[] args) {
            App app = new App();
            new UserStack(app, "user-stack");
            app.run();
    }

    public static class UserStack extends Stack {
        // Not able to add Tag and Create Access Key
        public UserStack(final App parent, final String name) {
            super(parent, name);

            PolicyStatement statement = new PolicyStatement(PolicyStatementEffect.Allow);
            statement.addResource("*");
            statement.addAction("lambda:UpdateFunctionCode");

            User user = new User(this, "LambdaDeployer", UserProps.builder().withUserName("lambda-deployer").withPath("/").build());
            user.addToPolicy(statement);

            Tag tag = new Tag("Project", "devops");
            // how to tag the user ??

            new CfnOutput(this, "LambdaDeployerOutputAccessKey", CfnOutputProps.builder().withValue("AWS::IAM::AccessKey").build());
            new CfnOutput(this, "LambdaDeployerOutputSecretAccessKey", CfnOutputProps.builder().withValue("AWS::IAM::SecretAccessKey").build());
        }
    }
}

Answer 1

您可能必须使用Custom Resource才能调用TagUser API，因为向用户添加标签是not available natively in CloudFormation。

您可以使用CDK中的一项新功能来帮助您创作自定义资源：https://github.com/awslabs/aws-cdk/pull/1850

AWS IAM CDK：标记和创建用户访问密钥

1 个答案: