fix(elasticloadbalancingv2): least privilege invoke permission

aws · Mar 25, 2024 · 9ebb84a · 9ebb84a
1 parent 432f97d
commit 9ebb84a
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/packages/aws-cdk-lib/aws-elasticloadbalancingv2-targets/lib/lambda-target.ts b/packages/aws-cdk-lib/aws-elasticloadbalancingv2-targets/lib/lambda-target.ts
@@ -18,8 +18,7 @@ export class LambdaTarget implements elbv2.IApplicationLoadBalancerTarget {
    * load balancer.
    */
   public attachToApplicationTargetGroup(targetGroup: elbv2.IApplicationTargetGroup): elbv2.LoadBalancerTargetProps {
-    const grant = this.fn.grantInvoke(new iam.ServicePrincipal('elasticloadbalancing.amazonaws.com'));
-    grant.applyBefore(targetGroup);
+    this.fn.addPermission('Permission', { principal: new iam.ServicePrincipal('elasticloadbalancing.amazonaws.com'), sourceArn: targetGroup.targetGroupArn });
     return this.attach(targetGroup);
   }
 
@@ -30,8 +29,7 @@ export class LambdaTarget implements elbv2.IApplicationLoadBalancerTarget {
    * load balancer.
    */
   public attachToNetworkTargetGroup(targetGroup: elbv2.INetworkTargetGroup): elbv2.LoadBalancerTargetProps {
-    const grant = this.fn.grantInvoke(new iam.ServicePrincipal('elasticloadbalancing.amazonaws.com'));
-    grant.applyBefore(targetGroup);
+    this.fn.addPermission('Permission', { principal: new iam.ServicePrincipal('elasticloadbalancing.amazonaws.com'), sourceArn: targetGroup.targetGroupArn });
     return this.attach(targetGroup);
   }
 

diff --git a/packages/aws-cdk-lib/aws-elasticloadbalancingv2-targets/test/lambda-target.test.ts b/packages/aws-cdk-lib/aws-elasticloadbalancingv2-targets/test/lambda-target.test.ts
@@ -48,3 +48,16 @@ test('Lambda targets create dependency on Invoke permission', () => {
     return (def.DependsOn ?? []).includes('FunInvokeServicePrincipalelasticloadbalancingamazonawscomD2CAC0C4');
   });
 });
+
+test('Lambda targets create least privilege permission', () => {
+  // WHEN
+  listener.addTargets('Targets', {
+    targets: [new targets.LambdaTarget(fn)],
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
+    Principal: 'elasticloadbalancing.amazonaws.com',
+    SourceArn: { Ref: 'LBListenerTargetsGroup76EF81E8' },
+  });
+});