Improving role security

create-role/index.js

@@ -1,40 +1,48 @@
 const AWS = require('aws-sdk');
 const iam = new AWS.IAM();
+const sts = new AWS.STS();
 const roleName = 'serverless-notifications';
 
-const createRoleParams = {
-  AssumeRolePolicyDocument: `{
-    "Version":"2012-10-17",
-    "Statement":[{
-        "Effect": "Allow",
-        "Principal": {
-          "AWS": "*"
-        },
-        "Action": "sts:AssumeRole"
-      }
-    ]
-  }`,
-  RoleName: roleName
-};
-
-iam.createRole(createRoleParams, (err, data) => {
+// get the account id
+sts.getCallerIdentity({}, (err, data) => {
   if (err) return console.log(err, err.stack);
 
-  const attachPolicyParams = {
-    PolicyDocument: `{
-      "Version": "2012-10-17",
-      "Statement": [{
-        "Action": ["iot:Connect", "iot:Subscribe", "iot:Publish", "iot:Receive"],
-        "Resource": "*",
-        "Effect": "Allow"
-      }]
+  const createRoleParams = {
+    AssumeRolePolicyDocument: `{
+      "Version":"2012-10-17",
+      "Statement":[{
+          "Effect": "Allow",
+          "Principal": {
+            "AWS": "arn:aws:iam::${data.Account}:root"
+          },
+          "Action": "sts:AssumeRole"
+        }
+      ]
     }`,
-    PolicyName: roleName,
     RoleName: roleName
   };
 
-  iam.putRolePolicy(attachPolicyParams, (err, data) => {
-    if (err) console.log(err, err.stack);
-    else     console.log(`Finished creating IoT Role: ${roleName}`);          
+  // create role
+  iam.createRole(createRoleParams, (err, data) => {
+    if (err) return console.log(err, err.stack);
+
+    const attachPolicyParams = {
+      PolicyDocument: `{
+        "Version": "2012-10-17",
+        "Statement": [{
+          "Action": ["iot:Connect", "iot:Subscribe", "iot:Publish", "iot:Receive"],
+          "Resource": "*",
+          "Effect": "Allow"
+        }]
+      }`,
+      PolicyName: roleName,
+      RoleName: roleName
+    };
+
+    // add iot policy
+    iam.putRolePolicy(attachPolicyParams, (err, data) => {
+      if (err) console.log(err, err.stack);
+      else     console.log(`Finished creating IoT Role: ${roleName}`);          
+    });
   });
 });