Permission

Source: src/AWS/RAM/Permission.ts

An AWS Resource Access Manager (RAM) customer managed permission.

A customer managed permission precisely controls which actions principals receive on resources of a given type when you attach the permission to a ResourceShare via permissionArns.

Creating a Permission

Least-privilege AppSync API sharing

const permission = yield* Permission("SourceGraphQLOnly", {
  resourceType: "appsync:Apis",
  policyTemplate: {
    actions: ["appsync:SourceGraphQL"],
  },
});

Attach a permission to a resource share

const share = yield* ResourceShare("ApiShare", {
  resourceArns: [api.apiArn],
  principals: ["123456789012"],
  permissionArns: [permission.permissionArn],
});

Updating the Policy

const permission = yield* Permission("SourceGraphQLOnly", {
  resourceType: "appsync:Apis",
  policyTemplate: {
    actions: ["appsync:SourceGraphQL", "appsync:GraphQL"],
  },
});