Fix CRLY.01173: Constrain IAM Permissions Management

pipeline/cfn-deploypipeline-s3.yaml

@@ -169,9 +169,12 @@ Resources:
                             - 'iam:PassRole'
                             - 'lambda:InvokeFunction'
                             - 'lambda:ListFunctions'
-                            - 'lambda:InvokeAsyc'
                           Effect: Allow
-                          Resource: '*'
+                          Resource:
+                            - arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME
+                          Condition:
+                            StringEquals:
+                              aws:ResourceAccount: ACCOUNT_ID
     Pipeline:
         Type: AWS::CodePipeline::Pipeline
         Properties:
@@ -264,55 +267,4 @@ Resources:
                                 Provider: Lambda
                                 Version: 1
                             Configuration:
-                                FunctionName: !Ref LambdaSlackNotify
-    IamRoleLambdaSlackNotify:
-        Type: AWS::IAM::Role
-        Properties:
-            AssumeRolePolicyDocument:
-                Version: '2012-10-17'
-                Statement:
-                    -
-                        Effect: Allow
-                        Principal:
-                            Service:
-                                - lambda.amazonaws.com
-                        Action:
-                            - sts:AssumeRole
-            ManagedPolicyArns:
-                - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
-            Path: "/"
-    IamPolicyLambdaSlackNotify1:
-        Type: AWS::IAM::Policy
-        Properties:
-            PolicyName: CodePipelineAccess
-            PolicyDocument:
-                Version: '2012-10-17'
-                Statement:
-                -
-                    Effect: Allow
-                    Action:
-                        - codepipeline:Get*
-                        - codepipeline:PutJob*
-                    Resource: "*"
-            Roles:
-                - Ref: IamRoleLambdaSlackNotify
-    LambdaSlackNotify:
-        Type: AWS::Serverless::Function
-        Properties:
-            Description: Sends CodePipeline events to Slack
-            Runtime: python2.7
-            CodeUri: ./functions/slack-notify
-            Handler: handler.handler
-            MemorySize: 128
-            Timeout: 30
-            Role: !GetAtt IamRoleLambdaSlackNotify.Arn
-            Environment:
-                Variables:
-                    SLACK_CHANNEL_NAME:
-                        !Ref SlackChannelName
-                    SLACK_WEBHOOK_URL:
-                        !Ref SlackWebhookUrl
-                    SERVICE_NAME:
-                        !Ref ServiceName
-                    STAGE:
-                        !Ref Stage
+