s3 bucket notifications creates IAM policy that has no resource boundary

Forked off from https://github.com/aws/aws-cdk/issues/2781, specifically this comment

S3 bucket notifications creates an IAM role holding a policy that contains no resource boundary, specifically "Resource": "*".

Companies typically enforce that all IAM policies should be well bounded in their actions and resource.

https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-s3-notifications/test/integ.notifications.expected.json#L188-L208

[iliapolo]

@binhrobles

Is there an easier/clearer way to get to these constructs, or is this pretty much the way to do it for now?

Thats pretty the way as of now. You could simplify a little by using the well known notification handler id:

const bucketNotificationsHandler = Stack.of(this).node.tryFindChild('BucketNotificationsHandler050a0587b7544547bf325f094a3db834')!

But that’s not a WHOLE lot better…actually for your use-cases, I would recommend having a look at Aspects - which give you a way of visiting every construct just before synthesis happens, and modify it to fit your needs.

Escape hatches are mainly for pin point mutations to the underlying CloudFormation resource properties.

[github-actions[bot]]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.