twitter-dashboard/deployment/lambda_iam.yaml at main · ysano/twitter-dashboard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
AWSTemplateFormatVersion: "2010-09-09"
Metadata:
    Generator: "former2"
Description: ""
Resources:
    IAMManagedPolicy:
        Type: "AWS::IAM::ManagedPolicy"
        Properties:
            ManagedPolicyName: "TweetAnalysisLambdaFuntionPolicy"
            Path: "/"
            PolicyDocument: !Sub |
                {

                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "s3:GetObject",
                                "s3:PutObject",
                                "s3:ListBucket",
                                "s3:PutBucketNotification",
                                "s3:DeleteBucket"
                            ],
                            "Resource": [
                                "arn:aws:s3:::twitter-dashboard-ysano-01",
                                "arn:aws:s3:::twitter-dashboard-ysano-01/*"
                            ]
                        },
                        {
                            "Effect": "Allow",
                            "Action": [
                                "logs:CreateLogGroup",
                                "logs:CreateLogStream",
                                "logs:PutLogEvents"
                            ],
                            "Resource": [
                                "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*"
                            ]
                        },
                        {
                            "Effect": "Allow",
                            "Action": [
                                "firehose:ListDeliveryStreams",
                                "firehose:PutRecord",
                                "firehose:PutRecordBatch"
                            ],
                            "Resource": [
                                "arn:aws:firehose:${AWS::Region}:${AWS::AccountId}:deliverystream/Twitter-Dashboard-Entities",
                                "arn:aws:firehose:${AWS::Region}:${AWS::AccountId}:deliverystream/Twitter-Dashboard-Sentiment"
                            ]
                        },
                        {
                            "Effect": "Allow",
                            "Action": [
                                "comprehend:DetectEntities",
                                "comprehend:DetectSentiment"
                            ],
                            "Resource": "*"
                        }
                    ]
                }