feat(policy-template): add MobileAnalyticsWriteOnlyAccessPolicy and P…

…inpointEndpointAccessPolicy policy templates (#408)
aws · May 23, 2018 · c5a60ab · c5a60ab
1 parent fc92744
commit c5a60ab
Show file tree

Hide file tree

Showing 6 changed files with 209 additions and 0 deletions.
diff --git a/docs/policy_templates_data/policy_templates.json b/docs/policy_templates_data/policy_templates.json
@@ -1133,6 +1133,51 @@
         }]
       }
     },
+    "MobileAnalyticsWriteOnlyAccessPolicy": {
+      "Description": "Gives write only permissions to put event data for all application resources",
+      "Parameters": {},
+      "Definition": {
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "mobileanalytics:PutEvents"
+            ],
+            "Resource": "*"
+          }
+        ]
+      }
+    },
+    "PinpointEndpointAccessPolicy": {
+      "Description": "Gives permissions to get and update endpoints for a Pinpoint application",
+      "Parameters": {
+        "PinpointApplicationId": {
+          "Description": "The id of your Pinpoint application"
+        }
+      },
+      "Definition": {
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "mobiletargeting:GetEndpoint",
+              "mobiletargeting:UpdateEndpoint",
+              "mobiletargeting:UpdateEndpointsBatch"
+            ],
+            "Resource": {
+              "Fn::Sub": [
+                "arn:${AWS::Partition}:mobiletargeting:${AWS::Region}:${AWS::AccountId}:apps/${pinpointApplicationId}/endpoints/*",
+                {
+                  "pinpointApplicationId": {
+                    "Ref": "PinpointApplicationId"
+                  }
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
     "FirehoseWritePolicy": {
       "Description": "Gives permission to write to a Kinesis Firehose Delivery Stream",
       "Parameters": {

diff --git a/samtranslator/policy_templates_data/policy_templates.json b/samtranslator/policy_templates_data/policy_templates.json
@@ -1156,6 +1156,53 @@
         ]
       }
     },
+    "MobileAnalyticsWriteOnlyAccessPolicy": {
+      "Description": "Gives write only permissions to put event data for all application resources",
+      "Parameters": {
+
+      },
+      "Definition": {
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "mobileanalytics:PutEvents"
+            ],
+            "Resource": "*"
+          }
+        ]
+      }
+    },
+    "PinpointEndpointAccessPolicy": {
+      "Description": "Gives permissions to get and update endpoints for a Pinpoint application",
+      "Parameters": {
+        "PinpointApplicationId": {
+          "Description": "The id of your Pinpoint application"
+        }
+      },
+      "Definition": {
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+              "mobiletargeting:GetEndpoint",
+              "mobiletargeting:UpdateEndpoint",
+              "mobiletargeting:UpdateEndpointsBatch"
+            ],
+            "Resource": {
+              "Fn::Sub": [
+                "arn:${AWS::Partition}:mobiletargeting:${AWS::Region}:${AWS::AccountId}:apps/${pinpointApplicationId}/endpoints/*",
+                {
+                  "pinpointApplicationId": {
+                    "Ref": "PinpointApplicationId"
+                  }
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
     "FirehoseWritePolicy": {
       "Description": "Gives permission to write to a Kinesis Firehose Delivery Stream",
       "Parameters": {

diff --git a/tests/translator/input/all_policy_templates.yaml b/tests/translator/input/all_policy_templates.yaml
@@ -113,3 +113,8 @@ Resources:
 
         - AWSSecretsManagerRotationPolicy:
             FunctionName: function
+
+        - MobileAnalyticsWriteOnlyAccessPolicy: {}
+
+        - PinpointEndpointAccessPolicy:
+            PinpointApplicationId: id
diff --git a/tests/translator/output/all_policy_templates.json b/tests/translator/output/all_policy_templates.json
@@ -950,6 +950,43 @@
                 }
               ]
             }
+          },
+          {
+            "PolicyName": "KitchenSinkFunctionRolePolicy37", 
+            "PolicyDocument": {
+              "Statement": [
+                {
+                  "Action": [
+                    "mobileanalytics:PutEvents"
+                  ],
+                  "Resource": "*", 
+                  "Effect": "Allow"
+                }
+              ]
+            }
+          },
+          {
+            "PolicyName": "KitchenSinkFunctionRolePolicy38",
+            "PolicyDocument": {
+              "Statement": [
+                {
+                  "Action": [
+                    "mobiletargeting:GetEndpoint",
+                    "mobiletargeting:UpdateEndpoint",
+                    "mobiletargeting:UpdateEndpointsBatch"
+                  ],
+                  "Resource": {
+                    "Fn::Sub": [
+                      "arn:${AWS::Partition}:mobiletargeting:${AWS::Region}:${AWS::AccountId}:apps/${pinpointApplicationId}/endpoints/*",
+                      {
+                        "pinpointApplicationId": "id"
+                      }
+                    ]
+                  },
+                  "Effect": "Allow"
+                }
+              ]
+            }
           }
         ], 
         "AssumeRolePolicyDocument": {

diff --git a/tests/translator/output/aws-cn/all_policy_templates.json b/tests/translator/output/aws-cn/all_policy_templates.json
@@ -950,6 +950,43 @@
                 }
               ]
             }
+          },
+          {
+            "PolicyName": "KitchenSinkFunctionRolePolicy37", 
+            "PolicyDocument": {
+              "Statement": [
+                {
+                  "Action": [
+                    "mobileanalytics:PutEvents"
+                  ], 
+                  "Resource": "*", 
+                  "Effect": "Allow"
+                }
+              ]
+            }
+          },
+          {
+            "PolicyName": "KitchenSinkFunctionRolePolicy38",
+            "PolicyDocument": {
+              "Statement": [
+                {
+                  "Action": [
+                    "mobiletargeting:GetEndpoint",
+                    "mobiletargeting:UpdateEndpoint",
+                    "mobiletargeting:UpdateEndpointsBatch"
+                  ],
+                  "Resource": {
+                    "Fn::Sub": [
+                      "arn:${AWS::Partition}:mobiletargeting:${AWS::Region}:${AWS::AccountId}:apps/${pinpointApplicationId}/endpoints/*",
+                      {
+                        "pinpointApplicationId": "id"
+                      }
+                    ]
+                  },
+                  "Effect": "Allow"
+                }
+              ]
+            }
           }
         ], 
         "AssumeRolePolicyDocument": {

diff --git a/tests/translator/output/aws-us-gov/all_policy_templates.json b/tests/translator/output/aws-us-gov/all_policy_templates.json
@@ -950,6 +950,44 @@
                 }
               ]
             }
+          },
+          {
+            "PolicyName": "KitchenSinkFunctionRolePolicy37", 
+            "PolicyDocument": {
+              "Statement": [
+                {
+                  "Action": [
+                    "mobileanalytics:PutEvents"
+                  ], 
+                  "Resource": "*", 
+                  "Effect": "Allow"
+                }
+              ]
+            }
+          },
+          {
+            "PolicyName": "KitchenSinkFunctionRolePolicy38",
+            "PolicyDocument": {
+              "Statement": [
+                {
+                  "Action": [
+                    "mobiletargeting:GetEndpoint",
+                    "mobiletargeting:UpdateEndpoint",
+                    "mobiletargeting:UpdateEndpointsBatch"
+                  ],
+                  "Resource": {
+                    "Fn::Sub": [
+                      "arn:${AWS::Partition}:mobiletargeting:${AWS::Region}:${AWS::AccountId}:apps/${pinpointApplicationId}/endpoints/*",
+                      {
+                        "pinpointApplicationId": "id"
+                      }
+                    ]
+                  }
+                  ,
+                  "Effect": "Allow"
+                }
+              ]
+            }
           }
         ], 
         "AssumeRolePolicyDocument": {