CDKTF是否有类似AWS CDK的grantReadWriteData权限授予方法？

CDKTF目前没有AWS CDK里那种开箱即用的grantReadWriteData这类高层封装方法，你需要手动编写IAM策略语句并附加到Lambda函数的执行角色上。

举个TypeScript的示例，实现给Lambda授予DynamoDB表读写权限的逻辑：

1. 先定义DynamoDB表和Lambda执行角色

import { Construct } from "constructs";
import { TerraformStack } from "cdktf";
import { aws_dynamodb as dynamodb, aws_iam as iam, aws_lambda as lambda } from "@cdktf/provider-aws";

class MyStack extends TerraformStack {
  constructor(scope: Construct, name: string) {
    super(scope, name);

    // 创建DynamoDB表
    const table = new dynamodb.Table(this, "MyTable", {
      name: "my-table",
      hashKey: "id",
      attribute: [{ name: "id", type: "S" }],
      billingMode: "PAY_PER_REQUEST",
    });

    // 创建Lambda执行角色
    const lambdaRole = new iam.IamRole(this, "LambdaRole", {
      name: "lambda-db-access-role",
      assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
          Action: "sts:AssumeRole",
          Effect: "Allow",
          Principal: { Service: "lambda.amazonaws.com" }
        }]
      }),
    });

2. 编写IAM策略并附加到角色

// 定义允许DynamoDB读写的策略语句
    const dbReadWritePolicy = new iam.IamPolicy(this, "DbReadWritePolicy", {
      name: "lambda-db-read-write-policy",
      policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
          Effect: "Allow",
          Action: [
            "dynamodb:GetItem",
            "dynamodb:PutItem",
            "dynamodb:UpdateItem",
            "dynamodb:DeleteItem",
            "dynamodb:Scan",
            "dynamodb:Query"
          ],
          Resource: table.arn // 关联目标表的ARN
        }]
      }),
    });

    // 将策略附加到Lambda角色
    new iam.IamRolePolicyAttachment(this, "LambdaDbPolicyAttachment", {
      role: lambdaRole.name,
      policyArn: dbReadWritePolicy.arn,
    });

    // 创建Lambda函数并关联角色
    const myLambda = new lambda.Function(this, "MyLambda", {
      functionName: "my-lambda",
      handler: "index.handler",
      runtime: "nodejs18.x",
      role: lambdaRole.arn,
      // 其他配置...
    });
  }
}

如果你需要频繁复用这类权限授予逻辑，可以自己封装一个辅助函数，比如：

function grantReadWriteData(table: dynamodb.Table, role: iam.IamRole, scope: Construct) {
  const policy = new iam.IamPolicy(scope, `${table.name}-read-write-policy`, {
    name: `${table.name}-read-write-policy`,
    policy: JSON.stringify({
      Version: "2012-10-17",
      Statement: [{
        Effect: "Allow",
        Action: [
          "dynamodb:GetItem",
          "dynamodb:PutItem",
          "dynamodb:UpdateItem",
          "dynamodb:DeleteItem",
          "dynamodb:Scan",
          "dynamodb:Query"
        ],
        Resource: table.arn
      }]
    }),
  });

  new iam.IamRolePolicyAttachment(scope, `${table.name}-read-write-attachment`, {
    role: role.name,
    policyArn: policy.arn,
  });
}

// 使用时直接调用
grantReadWriteData(table, lambdaRole, this);

这样就能实现类似AWS CDK中grantReadWriteData的便捷效果。

内容的提问来源于stack exchange，提问作者Ali Khalil