Fix CRLY.01176: Constrain IAM Write Access

pipeline/cfn-deploypipeline-github.yaml

@@ -181,7 +181,9 @@ Resources:
                             - 'lambda:ListFunctions'
                             - 'lambda:InvokeAsyc'
                           Effect: Allow
-                          Resource: '*'
+                          Resource:
+                            - arn:aws:iam::123456789012:role/specific-role
+                            - arn:aws:lambda:us-east-1:123456789012:function:specific-function
     Pipeline:
         Type: AWS::CodePipeline::Pipeline
         Properties:
@@ -259,72 +261,4 @@ Resources:
                             Name: ExecuteChangeSetSlackNotification
                             ActionTypeId:
                                 Category: Invoke
-                                Owner: AWS
-                                Provider: Lambda
-                                Version: 1
-                            Configuration:
-                                FunctionName: !Ref LambdaSlackNotify
-                            RunOrder: 1
-                -
-                    Name: Complete
-                    Actions:
-                        -
-                            Name: CompletionNotification
-                            ActionTypeId:
-                                Category: Invoke
-                                Owner: AWS
-                                Provider: Lambda
-                                Version: 1
-                            Configuration:
-                                FunctionName: !Ref LambdaSlackNotify
-    IamRoleLambdaSlackNotify:
-        Type: AWS::IAM::Role
-        Properties:
-            AssumeRolePolicyDocument:
-                Version: '2012-10-17'
-                Statement:
-                    -
-                        Effect: Allow
-                        Principal:
-                            Service:
-                                - lambda.amazonaws.com
-                        Action:
-                            - sts:AssumeRole
-            ManagedPolicyArns:
-                - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
-            Path: "/"
-    IamPolicyLambdaSlackNotify1:
-        Type: AWS::IAM::Policy
-        Properties:
-            PolicyName: CodePipelineAccess
-            PolicyDocument:
-                Version: '2012-10-17'
-                Statement:
-                -
-                    Effect: Allow
-                    Action:
-                        - codepipeline:Get*
-                        - codepipeline:PutJob*
-                    Resource: "*"
-            Roles:
-                - Ref: IamRoleLambdaSlackNotify
-    LambdaSlackNotify:
-        Type: AWS::Serverless::Function
-        Properties:
-            Description: Sends CodePipeline events to Slack
-            Runtime: python2.7
-            CodeUri: ./functions/slack-notify
-            Handler: handler.handler
-            MemorySize: 128
-            Timeout: 30
-            Role: !GetAtt IamRoleLambdaSlackNotify.Arn
-            Environment:
-                Variables:
-                    SLACK_CHANNEL_NAME:
-                        !Ref SlackChannelName
-                    SLACK_WEBHOOK_URL:
-                        !Ref SlackWebhookUrl
-                    SERVICE_NAME:
-                        !Ref ServiceName
-                    STAGE:
-                        !Ref Stage
+