fix(pulumi-aws): ddb to es log permissions (#4659)

Author: brunozoric

packages/pulumi-aws/src/apps/core/CoreElasticSearch.ts

@@ -281,6 +281,8 @@ function getDynamoDbToElasticLambdaPolicy(
     app: PulumiApp,
     domain: pulumi.Output<aws.elasticsearch.Domain | aws.elasticsearch.GetDomainResult>
 ) {
+    const logDynamoDbTable = app.getModule(LogDynamo);
+
     return app.addResource(aws.iam.Policy, {
         name: "DynamoDbToElasticLambdaPolicy-updated",
         config: {
@@ -296,19 +298,30 @@ function getDynamoDbToElasticLambdaPolicy(
                             "es:ESHttpDelete",
                             "es:ESHttpPatch",
                             "es:ESHttpPost",
-                            "es:ESHttpPut",
-                            "dynamodb:BatchGetItem",
-                            "dynamodb:BatchWriteItem",
-                            "dynamodb:PutItem",
-                            "dynamodb:GetItem",
-                            "dynamodb:DeleteItem",
-                            "dynamodb:Query",
-                            "dynamodb:UpdateItem"
+                            "es:ESHttpPut"
                         ],
                         Resource: [
                             pulumi.interpolate`${domain.arn}`,
                             pulumi.interpolate`${domain.arn}/*`
                         ]
+                    },
+                    {
+                        Sid: "PermissionForDynamoDbLog",
+                        Effect: "Allow",
+                        Action: [
+                            "dynamodb:GetItem",
+                            "dynamodb:PutItem",
+                            "dynamodb:UpdateItem",
+                            "dynamodb:DeleteItem",
+                            "dynamodb:BatchGetItem",
+                            "dynamodb:BatchWriteItem",
+                            "dynamodb:Scan",
+                            "dynamodb:Query"
+                        ],
+                        Resource: [
+                            pulumi.interpolate`${logDynamoDbTable.output.arn}`,
+                            pulumi.interpolate`${logDynamoDbTable.output.arn}/*`
+                        ]
                     }
                 ]
             }

packages/pulumi-aws/src/apps/core/CoreOpenSearch.ts

@@ -10,9 +10,9 @@ import * as random from "@pulumi/random";
 import {
     createAppModule,
     PulumiApp,
+    PulumiAppRemoteResource,
     PulumiAppResource,
-    PulumiAppResourceConstructor,
-    PulumiAppRemoteResource
+    PulumiAppResourceConstructor
 } from "@webiny/pulumi";
 
 import { getAwsAccountId } from "../awsUtils";
@@ -294,6 +294,8 @@ function getDynamoDbToElasticLambdaPolicy(
     app: PulumiApp,
     domain: pulumi.Output<aws.opensearch.Domain | aws.opensearch.GetDomainResult>
 ) {
+    const logDynamoDbTable = app.getModule(LogDynamo);
+
     return app.addResource(aws.iam.Policy, {
         name: "DynamoDbToElasticLambdaPolicy-updated",
         config: {
@@ -309,19 +311,30 @@ function getDynamoDbToElasticLambdaPolicy(
                             "es:ESHttpDelete",
                             "es:ESHttpPatch",
                             "es:ESHttpPost",
-                            "es:ESHttpPut",
-                            "dynamodb:BatchGetItem",
-                            "dynamodb:BatchWriteItem",
-                            "dynamodb:PutItem",
-                            "dynamodb:GetItem",
-                            "dynamodb:DeleteItem",
-                            "dynamodb:Query",
-                            "dynamodb:UpdateItem"
+                            "es:ESHttpPut"
                         ],
                         Resource: [
                             pulumi.interpolate`${domain.arn}`,
                             pulumi.interpolate`${domain.arn}/*`
                         ]
+                    },
+                    {
+                        Sid: "PermissionForDynamoDbLog",
+                        Effect: "Allow",
+                        Action: [
+                            "dynamodb:GetItem",
+                            "dynamodb:PutItem",
+                            "dynamodb:UpdateItem",
+                            "dynamodb:DeleteItem",
+                            "dynamodb:BatchGetItem",
+                            "dynamodb:BatchWriteItem",
+                            "dynamodb:Scan",
+                            "dynamodb:Query"
+                        ],
+                        Resource: [
+                            pulumi.interpolate`${logDynamoDbTable.output.arn}`,
+                            pulumi.interpolate`${logDynamoDbTable.output.arn}/*`
+                        ]
                     }
                 ]
             }