@@ -16,14 +16,6 @@ export class OrdersStack extends Stack {
1616 super(scope, id, props);
1717
1818- const invoices = new s3.Bucket(this, 'Invoices', {
1919- encryption: s3.BucketEncryption.S3_MANAGED,
2020- blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
2121- enforceSSL: true,
2222- versioned: true,
2323- });
18+ const invoices = new SecureBucket(this, 'Invoices');
These four settings are copied into 4 stacks, and one copy already drifted. SecureBucket sets them once, so a new bucket can’t ship without encryption.
2419
2520 const handler = new OrdersHandler(this, 'Handler');
2626- handler.addToRolePolicy(new iam.PolicyStatement({
2727- actions: ['dynamodb:*'],
2828- resources: ['*'],
2929- }));
21+ table.grantReadWriteData(handler);
This gives the handler every DynamoDB action on every table in the account. The grant limits it to reading and writing this one table.