feautre: remove extra permissions from DB dal (#897)

ran-isenberg · web-flow · commit b6495dbaf66c · 2024-11-10T14:04:10.000+02:00
diff --git a/cdk/service/api_construct.py b/cdk/service/api_construct.py
@@ -76,7 +76,7 @@ def _build_lambda_role(self, db: dynamodb.TableV2, idempotency_table: dynamodb.T
                 'dynamodb_db': iam.PolicyDocument(
                     statements=[
                         iam.PolicyStatement(
-                            actions=['dynamodb:PutItem', 'dynamodb:GetItem'],
+                            actions=['dynamodb:PutItem'],
                             resources=[db.table_arn],
                             effect=iam.Effect.ALLOW,
                         )

Original file line number	Diff line number	Diff line change
`@@ -76,7 +76,7 @@ def _build_lambda_role(self, db: dynamodb.TableV2, idempotency_table: dynamodb.T`
`76`	`76`	`'dynamodb_db': iam.PolicyDocument(`
`77`	`77`	`statements=[`
`78`	`78`	`iam.PolicyStatement(`
`79`		`- actions=['dynamodb:PutItem', 'dynamodb:GetItem'],`
	`79`	`+ actions=['dynamodb:PutItem'],`
`80`	`80`	`resources=[db.table_arn],`
`81`	`81`	`effect=iam.Effect.ALLOW,`
`82`	`82`	`)`