medium.bastion-host.createLambdaRole.ts

createLambdaRole.ts

  private createLambdaRole(): iam.Role {
    const lambdaDocument = new iam.PolicyDocument();
    const associateAddressStatement = new iam.PolicyStatement();
    associateAddressStatement.addActions("ec2:AssociateAddress");
    associateAddressStatement.addResources();
    const logStatement = new iam.PolicyStatement()
    logStatement.addActions("logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents");
    logStatement.addAllResources()
    lambdaDocument.addStatements(associateAddressStatement, logStatement);

    return new iam.Role(this, "LambdaExecutionRole", {
      assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
      inlinePolicies: {
        "AllowAssociateAddress": lambdaDocument
      }
    })
  }