Per function role without (or with empty) iamRoleStatements about serverless-iam-roles-per-function

[glicht]

Ok. Thanks for the clarification. I think this can be fixed easily. Will check this out soon.

[glicht]

@buggy thanks for the workaround suggestion. Anyway, I just published a new version (0.1.9) which should fix this issue.

[glicht]

Hi @jogold ,

The second function should be getting its own iam role as it has an iamRoleStatements defined. The role will only include the permissions defined as part of iamRoleStatements clause and also permission to write to its cloudwatch logs group. It will not include vpc permissions, as the function doesn't have vpc settings defined.

Hope this makes sense. If you are still having issues run the following:

serverless package

Then include in the bug the full serverless.yml file and the file: .serverless/cloudformation-template-update-stack.json

[glicht]

I just read your description again. I think I might have mis-understood your issue. If I understand correctly you want the plugin to create a per function role for the first and third function even though there are no specific permissions defined in iamRoleStatements. The issue is not with the second function but with the first and third not receiving a per function role when using iamRoleStatements: [] . Am I correct?

[jogold]

Hi @glicht,

Yes, the issue is with the first and third function not receiving a per function role and the fact that even when using iamRoleStatements: [] it doesn't work.

[buggy]

I think something like this should do the trick

custom:
  defaultIamRoleStatements: &defaultIamRoleStatements
    # Put your default IAM statements here

functions:
  firstFunction:
    handler: functions/firstFunction.handler
    iamRoleStatements:
      <<: *defaultIamRoleStatements

  secondFunction:
    handler: functions/secondFunction.handler
    iamRoleStatements:
      - Effect: Allow
        Action: sns:Publish
        Resource: '*'

  thirdFunction:
    handler: functions/thirdFunction.handler
    iamRoleStatements:
      <<: *defaultIamRoleStatements
    vpc:
      securityGroupIds:
        - sg-xxxxxx
      subnetIds:
        - subnet-xxxx
        - subnet-xxxxx

[jogold]

Thanks @glicht!