fix(template): restrict lambdas permissions on s3 bucket

pharindoko · Aug 1, 2020 · 8ad34dc · 8ad34dc
1 parent 55826dc
commit 8ad34dc
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/packages/template/serverless.yml b/packages/template/serverless.yml
@@ -45,13 +45,15 @@ provider:
   iamRoleStatements:
     - Effect: 'Allow'
       Action:
-        - 's3:*'
-      Resource: '*'
+        - 's3:GetObject'
+        - 's3:PutObject'
+      Resource:
+        - 'arn:aws:s3:::${self:custom.file.s3Bucket}/*'
     - Effect: 'Allow'
       Action:
-        - 's3:*'
+        - 's3:ListBucket'
       Resource:
-        - 'arn:aws:s3:::${self:custom.file.s3Bucket}/*'
+        - 'arn:aws:s3:::${self:custom.file.s3Bucket}'
 
 # The `functions` block defines what code to deploy
 functions: