iam: add more granular grant permissions

[justinwiley]

Describe the feature

The IAM grant mechanism (grantWrite, grantRead, etc) should allow for additional parameters that can override the default permissions.

Use Case

The default permissions granted using grantWrite, grantRead etc can be overly permissive for certain usecases. For example bucket.grantWrite(principale) leads to the IAM permissions:

s3:Abort*
s3:DeleteObject*
s3:PutObject
s3:PutObjectLegalHold
s3:PutObjectRetention
s3:PutObjectTagging
s3:PutObjectVersionTagging

For certain usecases, these are overly permissive. One example is granting a principal access to a write only bucket containing an audit log; the principal shouldn't be able to delete objects.

Proposed Solution

One possible implementation:

const user = new iam.User(stack, 'audit-log-writer'))
const bucket = new s3.Bucket(this, 'audit-log-bucket', {...});
bucket.grantWrite(
  user, 
  null,
  ['s3:Abort*', 's3:DeleteObject*'] // proposed third option, which would include default actions to remove from the grant
)

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.63.2

Environment details (OS name and version, etc.)

mac os

[khushail]

Hi @justinwiley , thanks for reaching out and suggesting this feature request. I am marking this issue as p2, which means that we are unable to work on this immediately.

We use +1s to help prioritize our work, and are happy to revaluate this issue based on community feedback. You can reach out to the cdk.dev community on Slack to solicit support for reprioritization. Meanwhile, you could use Escape hatches as a workaround.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.