Using the Cloud Canvas Command Line to Manage Roles and Permissions

You can use the lmbr_aws command line tool to manage Cloud Canvas Resource Manager access control. For example, you can use the tool to assume a role when you run a command, or to manage roles, permissions, and role mappings.

Assuming a Role

Most lmbr_aws commands support an --assume-role <role-name> argument. You can use this argument to assume a role when you run a command.

If specified, <role-name> must be the logical resource ID of an IAM role resource defined in either the project-template.json or deployment-access-template.json files.

Note
You should avoid defining roles that have the same name in both files. If you do, the role from the deployment file takes precedence.

If you specify a deployment access role, the actual role used depends on the deployment on which the command is operating. If the --deployment argument has been specified, then the specified deployment is used. If the --deployment argument has not been specified and the user has specified a default deployment, the default deployment is used. If a default deployment has not been specified, the project’s default deployment is used.

lmbr_aws uses your configured AWS credentials to assume the specified role. See Configuration for a description of how the credentials are determined. The credentials must have permission to assume the role. For more information, see Granting a User Permission to Switch Roles .

Before assuming the role, the lmbr_aws tool uses credentials to read project configuration data from AWS. The ProjectAccess managed policy in the project-template.json file and the DeploymentAccess managed policy in the deployment-access-template.json file grant the permissions necessary to read this information. You can attach the corresponding managed policy to any IAM user that works on a project or deployment.

Note that administrative users created for an AWS account normally have permissions to assume roles and read project configuration. Administrative users typically have permission to perform any action on any resource owned by an account.

Role Management Commands

Role management commands manage the AWS::IAM::Role resource definitions in the project-template.json and deployment-access-template.json files. After you use these commands to make changes, you must update the project or deployment access stacks for the changes to take effect. For information about the permissions to perform this action, see Controlling Access to Resources.

lmbr_aws role add

Adds an AWS IAM role resource definition to the project-template.json file or deployment-access-template.json file.

lmbr_aws role remove

Removes an AWS IAM role resource definition from the project-template.json file or deployment-access-template.json file.

lmbr_aws role list

Lists the AWS IAM role definitions in the project-template.json and/or deployment-access-template.json files.

Output

The output is similar to the following example.

Scope      Name
---------- -------------------------------------------
Deployment DeploymentAdmin
Deployment DeploymentOwner
Deployment Player
Deployment PlayerLoginRole
Project    ProjectAdmin
Project    ProjectOwner
Project    PlayerAccessTokenExchangeExecution
Project    ProjectResourceHandlerExecution

Permission Metadata Management

The permission metadata management commands manage CloudCanvas Permissions metadata on resource definitions in the resource-group-template.json files. After you use these commands to make changes, you must update the project or deployment access stacks for the changes to take effect. For information about the permissions to perform this action, see Controlling Access to Resources.

lmbr_aws permission add

Adds Cloud Canvas Permissions metadata to an resource definition in a resource-group-template.json file.

lmbr_aws permission remove

Removes Cloud Canvas Permissions metadata from a resource definition in a resource-group-template.json file.

lmbr_aws permission list

Removes Cloud Canvas Permissions metadata from an resource definition in a resource-group-template.json file.

Output

The output is similar to the following example.

Resource Group Resource             Resource Type         Roles          Actions                                              ARN Suffixes
-------------- -------------------- --------------------- -------------- ---------------------------------------------------- ------------
DynamicContent ContentBucket        AWS::S3::Bucket       ServiceLambda  s3:GetObject                                         /*
DynamicContent ContentBucket        AWS::S3::Bucket       ContentRequest s3:*                                                 /*
DynamicContent ContentRequest       AWS::Lambda::Function Player         lambda:InvokeFunction
DynamicContent ServiceLambda        AWS::Lambda::Function ServiceApi     lambda:InvokeFunction
DynamicContent StagingSettingsTable AWS::DynamoDB::Table  ServiceLambda  dynamodb:GetItem, dynamodb:Scan, dynamodb:UpdateItem
DynamicContent StagingSettingsTable AWS::DynamoDB::Table  ContentRequest dynamodb:GetItem

Tip
To see all the resources players have access to through the game client, use the command:

lmbr_aws permission list --role Player

Role Mapping Metadata Management

Role mapping metadata management commands manage CloudCanvas RoleMappings metadata on AWS::IAM:Role resource definitions in the project-template.json and deployment-access-template.json files. After you use these commands to make changes, you must update the project or deployment access stacks for the changes to take effect. For information about the permissions to perform this action, see Controlling Access to Resources.

lmbr_aws role-mapping add

Adds Cloud Canvas RoleMappings metadata to an AWS IAM role definition in the project-template.json or deployment-access-template.json file.

lmbr_aws role-mapping remove

Removes an AWS IAM role resource definition from the project-template.json file or deployment-access-template.json file.

lmbr_aws role-mapping list

Lists the AWS IAM role definitions in the project-template.json and/or deployment-access-template.json files.

Output

The output is similar to the following example.

Scope      Actual Role                     Abstract Role                 Effect
---------- ------------------------------- ----------------------------- ------
Deployment DeploymentAdmin                 *.DeploymentAdmin             Allow
Deployment DeploymentOwner                 *.DeploymentAdmin             Allow
Deployment DeploymentOwner                 *.DeploymentOwner             Allow
Deployment Player                          *.Player                      Allow
Project    ProjectAdmin                    *.ProjectAdmin                Allow
Project    ProjectOwner                    *.ProjectAdmin                Allow
Project    ProjectOwner                    *.ProjectOwner                Allow