Added new permissions model (#137)

* Added new permissions model * Fixed hash error, Added choice over list for permissions * Added permissions fix for S3
awslabs · Aug 10, 2020 · 94c249a · 94c249a
1 parent 5b8c88a
commit 94c249a
Show file tree

Hide file tree

Showing 9 changed files with 3,933 additions and 3,830 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,48 +1,48 @@
-{
-  "name": "amplify-category-video",
-  "version": "3.0.3",
-  "description": "Plugin for Amplify to add support for live streaming. Made for Unicorn Trivia Workshop",
-  "main": "index.js",
-  "scripts": {
-    "postinstall": "node scripts/post-install.js",
-    "lint": "eslint .",
-    "lint-fix": "eslint . --fix"
-  },
-  "author": "wizage",
-  "license": "Apache 2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/awslabs/amplify-video.git"
-  },
-  "keywords": [
-    "amplify",
-    "plugin",
-    "video"
-  ],
-  "dependencies": {
-    "archiver": "^3.1.1",
-    "chalk": "^2.4.2",
-    "child_process": "^1.0.2",
-    "ejs": "^2.7.1",
-    "fs-extra": "^7.0.0",
-    "ini": "^1.3.5",
-    "inquirer": "^6.5.0",
-    "mime-types": "^2.1.21",
-    "ora": "^4.0.3",
-    "sha1": "^1.1.1",
-    "yaml": "^1.7.2"
-  },
-  "devDependencies": {
-    "eslint": "^7.2.0",
-    "eslint-config-airbnb": "^18.2.0",
-    "eslint-config-airbnb-base": "^13.2.0",
-    "eslint-plugin-import": "^2.21.2",
-    "eslint-plugin-jsx-a11y": "^6.3.0",
-    "eslint-plugin-react": "^7.20.0",
-    "eslint-plugin-react-hooks": "^4.0.0"
-  },
-  "bugs": {
-    "url": "https://github.com/awslabs/amplify-video/issues"
-  },
-  "homepage": "https://github.com/awslabs/amplify-video#readme"
-}
+{
+  "name": "amplify-category-video",
+  "version": "3.1.0-beta5",
+  "description": "Plugin for Amplify to add support for live streaming. Made for Unicorn Trivia Workshop",
+  "main": "index.js",
+  "scripts": {
+    "postinstall": "node scripts/post-install.js",
+    "lint": "eslint .",
+    "lint-fix": "eslint . --fix"
+  },
+  "author": "wizage",
+  "license": "Apache 2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/awslabs/amplify-video.git"
+  },
+  "keywords": [
+    "amplify",
+    "plugin",
+    "video"
+  ],
+  "dependencies": {
+    "archiver": "^3.1.1",
+    "chalk": "^2.4.2",
+    "child_process": "^1.0.2",
+    "ejs": "^2.7.1",
+    "fs-extra": "^7.0.0",
+    "ini": "^1.3.5",
+    "inquirer": "^6.5.0",
+    "mime-types": "^2.1.21",
+    "ora": "^4.0.3",
+    "sha1": "^1.1.1",
+    "yaml": "^1.7.2"
+  },
+  "devDependencies": {
+    "eslint": "^7.2.0",
+    "eslint-config-airbnb": "^18.2.0",
+    "eslint-config-airbnb-base": "^13.2.0",
+    "eslint-plugin-import": "^2.21.2",
+    "eslint-plugin-jsx-a11y": "^6.3.0",
+    "eslint-plugin-react": "^7.20.0",
+    "eslint-plugin-react-hooks": "^4.0.0"
+  },
+  "bugs": {
+    "url": "https://github.com/awslabs/amplify-video/issues"
+  },
+  "homepage": "https://github.com/awslabs/amplify-video#readme"
+}
diff --git a/...-utils/awscloudformation/cloudformation-templates/vod-helpers/InputTriggerLambda.template b/...-utils/awscloudformation/cloudformation-templates/vod-helpers/InputTriggerLambda.template
@@ -1,148 +1,153 @@
-Description: S3 Workflow
-
-Parameters:
-  pS3:
-    Type: String
-    Description: Store template and lambda package
-    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
-    Default: s3default
-  pSourceFolder:
-    Type: String
-    Description: Store template and lambda package
-    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
-    Default: vod-helpers
-  pInputS3:
-    Type: String
-    Description: ProjectName
-    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
-    Default: DefaultName
-  pInputS3Arn:
-    Type: String
-    Description: Input S3 Arn
-    Default: arn-default
-  pOutputS3:
-    Type: String
-    Description: ProjectName
-    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
-    Default: DefaultName
-  pOutputS3Arn:
-    Type: String
-    Description: Output S3 Arn
-    Default: arn-default
-  pFunctionName:
-    Type: String
-    Description: ProjectName
-    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
-    Default: BucketWatcher
-  pMediaConvertTemplate:
-    Type: String
-    Description: MediaConvert Template Arn
-    Default: arn-default
-  pFunctionHash:
-    Type: String
-    Description: FunctionHash
-    Default: default
-
-Resources:
-  BucketWatcher:
-    Type: AWS::Lambda::Function
-    Properties:
-      FunctionName: !Ref pFunctionName
-      Description: Sends a notification when a new object is put into the bucket
-      Handler: index.handler
-      Role: !GetAtt LambdaExecutionRole.Arn
-      Runtime: nodejs12.x
-      Timeout: 30
-      Code:
-        S3Bucket: !Ref pS3
-        S3Key: !Sub
-          - vod-helpers/InputLambda-${hash}.zip
-          - { hash: !Ref pFunctionHash }
-      Environment:
-        Variables:
-          ARN_TEMPLATE: !Ref pMediaConvertTemplate
-          MC_ROLE: !GetAtt MediaConvertRole.Arn
-          OUTPUT_BUCKET: !Ref pOutputS3
-
-  LambdaExecutionRole:
-    Type: AWS::IAM::Role
-    Properties:
-      AssumeRolePolicyDocument:
-        Version: '2012-10-17'
-        Statement:
-        - Effect: Allow
-          Principal: 
-            Service: 
-              - lambda.amazonaws.com
-          Action: 
-            - 'sts:AssumeRole'
-      Path: /
-      Policies:
-      - PolicyName: S3PolicyTesting
-        PolicyDocument:
-          Version: '2012-10-17'
-          Statement:
-              - Effect: Allow
-                Action:
-                  - logs:CreateLogGroup
-                  - logs:CreateLogStream
-                  - logs:PutLogEvents
-                Resource:
-                  - !Join ["", ["arn:aws:logs:", Ref: "AWS::Region", ":", Ref: "AWS::AccountId", ":log-group:/aws/lambda/*"]]
-              - Effect: Allow
-                Action:
-                  - mediaconvert:CreateJob
-                  - mediaconvert:CreateJobTemplate
-                  - mediaconvert:CreatePreset
-                  - mediaconvert:DeleteJobTemplate
-                  - mediaconvert:DeletePreset
-                  - mediaconvert:DescribeEndpoints
-                  - mediaconvert:GetJob
-                  - mediaconvert:GetJobTemplate
-                  - mediaconvert:GetQueue
-                  - mediaconvert:GetPreset
-                  - mediaconvert:ListJobTemplates
-                  - mediaconvert:ListJobs
-                  - mediaconvert:ListQueues
-                  - mediaconvert:ListPresets
-                  - mediaconvert:UpdateJobTemplate
-                Resource:
-                  - !Join ["", ["arn:aws:mediaconvert:", Ref: "AWS::Region", ":", Ref: "AWS::AccountId", ":*"]]
-              - Effect: Allow
-                Action:
-                  - iam:PassRole
-                Resource:
-                  - !GetAtt MediaConvertRole.Arn
-  MediaConvertRole:
-    Type: AWS::IAM::Role
-    Properties:
-      AssumeRolePolicyDocument:
-        Version: 2012-10-17
-        Statement:
-          - Effect: Allow
-            Principal:
-              Service:
-                - "mediaconvert.amazonaws.com"
-            Action:
-              - sts:AssumeRole
-      Policies:
-        - PolicyName: !Sub "${AWS::StackName}-mediatranscode-role"
-          PolicyDocument:
-            Statement:
-              - Effect: Allow
-                Action:
-                  - s3:GetObject
-                  - s3:PutObject
-                Resource:
-                  - !Sub "${pInputS3Arn}/*" 
-                  - !Sub "${pOutputS3Arn}/*" 
-              - Effect: Allow
-                Action:
-                  - "execute-api:Invoke"
-                Resource:
-                  - !Join ["", ["arn:aws:execute-api:", Ref: "AWS::Region", ":", Ref: "AWS::AccountId", ":*"]]
-
-Outputs:
-  oLambdaFunction:
-    Value: !GetAtt BucketWatcher.Arn
+Description: S3 Workflow
+
+Parameters:
+  pS3:
+    Type: String
+    Description: Store template and lambda package
+    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
+    Default: s3default
+  pSourceFolder:
+    Type: String
+    Description: Store template and lambda package
+    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
+    Default: vod-helpers
+  pInputS3:
+    Type: String
+    Description: ProjectName
+    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
+    Default: DefaultName
+  pInputS3Arn:
+    Type: String
+    Description: Input S3 Arn
+    Default: arn-default
+  pOutputS3:
+    Type: String
+    Description: ProjectName
+    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
+    Default: DefaultName
+  pOutputS3Arn:
+    Type: String
+    Description: Output S3 Arn
+    Default: arn-default
+  pFunctionName:
+    Type: String
+    Description: ProjectName
+    AllowedPattern: "[a-zA-Z][a-zA-Z0-9-_]*"
+    Default: BucketWatcher
+  pMediaConvertTemplate:
+    Type: String
+    Description: MediaConvert Template Arn
+    Default: arn-default
+  pFunctionHash:
+    Type: String
+    Description: FunctionHash
+    Default: default
+  env:
+    Type: String
+    Description: The environment name. e.g. Dev, Test, or Production.
+    Default: NONE
+
+Resources:
+  BucketWatcher:
+    Type: AWS::Lambda::Function
+    Properties:
+      FunctionName: !Ref pFunctionName
+      Description: Sends a notification when a new object is put into the bucket
+      Handler: index.handler
+      Role: !GetAtt LambdaExecutionRole.Arn
+      Runtime: nodejs12.x
+      Timeout: 30
+      Code:
+        S3Bucket: !Ref pS3
+        S3Key: !Sub
+          - vod-helpers/InputLambda-${hash}.zip
+          - { hash: !Ref pFunctionHash }
+      Environment:
+        Variables:
+          ARN_TEMPLATE: !Ref pMediaConvertTemplate
+          MC_ROLE: !GetAtt MediaConvertRole.Arn
+          OUTPUT_BUCKET: !Ref pOutputS3
+          ENV: !Ref env
+
+  LambdaExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+        - Effect: Allow
+          Principal: 
+            Service: 
+              - lambda.amazonaws.com
+          Action: 
+            - 'sts:AssumeRole'
+      Path: /
+      Policies:
+      - PolicyName: S3PolicyTesting
+        PolicyDocument:
+          Version: '2012-10-17'
+          Statement:
+              - Effect: Allow
+                Action:
+                  - logs:CreateLogGroup
+                  - logs:CreateLogStream
+                  - logs:PutLogEvents
+                Resource:
+                  - !Join ["", ["arn:aws:logs:", Ref: "AWS::Region", ":", Ref: "AWS::AccountId", ":log-group:/aws/lambda/*"]]
+              - Effect: Allow
+                Action:
+                  - mediaconvert:CreateJob
+                  - mediaconvert:CreateJobTemplate
+                  - mediaconvert:CreatePreset
+                  - mediaconvert:DeleteJobTemplate
+                  - mediaconvert:DeletePreset
+                  - mediaconvert:DescribeEndpoints
+                  - mediaconvert:GetJob
+                  - mediaconvert:GetJobTemplate
+                  - mediaconvert:GetQueue
+                  - mediaconvert:GetPreset
+                  - mediaconvert:ListJobTemplates
+                  - mediaconvert:ListJobs
+                  - mediaconvert:ListQueues
+                  - mediaconvert:ListPresets
+                  - mediaconvert:UpdateJobTemplate
+                Resource:
+                  - !Join ["", ["arn:aws:mediaconvert:", Ref: "AWS::Region", ":", Ref: "AWS::AccountId", ":*"]]
+              - Effect: Allow
+                Action:
+                  - iam:PassRole
+                Resource:
+                  - !GetAtt MediaConvertRole.Arn
+  MediaConvertRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - "mediaconvert.amazonaws.com"
+            Action:
+              - sts:AssumeRole
+      Policies:
+        - PolicyName: !Sub "${AWS::StackName}-mediatranscode-role"
+          PolicyDocument:
+            Statement:
+              - Effect: Allow
+                Action:
+                  - s3:GetObject
+                  - s3:PutObject
+                Resource:
+                  - !Sub "${pInputS3Arn}/*" 
+                  - !Sub "${pOutputS3Arn}/*" 
+              - Effect: Allow
+                Action:
+                  - "execute-api:Invoke"
+                Resource:
+                  - !Join ["", ["arn:aws:execute-api:", Ref: "AWS::Region", ":", Ref: "AWS::AccountId", ":*"]]
+
+Outputs:
+  oLambdaFunction:
+    Value: !GetAtt BucketWatcher.Arn
     Description: Watching s3 buckets all day