4 ms·
If the dev account role has different permissions, it doesn't matter. Of course (s)he tested it first in a dev account. The point is the context around roles ma
by xrd 8y ago
If the dev account role has different permissions, it doesn't matter. Of course (s)he tested it first in a dev account. The point is the context around roles matters much more than the code that runs inside it, a critical flaw of AWS. Fairly, this problem is definitely not just limited to AWS but I find their implementation particularly poor.
- scarface74 8y agoThat’s still the issue. You should have a custom role for each set of lambdas that make up a service. Your role and your lambdas should be in the same CF template that can be deployed together. Security best practices is for the role to have the least amount of privileges the lambda needs. Not just one generic “lambda role”. Whoever is responsible for production deployment could audit the role’s permissions and the definitions would be in source control.