Allow integration tests to run with narrower IAM permissions (#124)

Author: nhinsch

tests/integration/serverless.yml

@@ -1,4 +1,5 @@
-service: python-integration-tests
+# IAM permissions require service name to begin with 'integration-tests'
+service: integration-tests-python
 
 provider:
   name: aws
@@ -11,6 +12,9 @@ provider:
     DD_API_KEY: ${env:DD_API_KEY}
   lambdaHashingVersion: 20201221
   timeout: 15
+  iam:
+    # IAM permissions require that all functions are deployed with this role
+    role: "arn:aws:iam::601427279990:role/serverless-integration-test-lambda-role"
 
 layers:
   python27:

tests/integration/snapshots/logs/async-metrics_python27.log

@@ -1,27 +1,27 @@
 START RequestId: XXXX Version: $LATEST
-{"e": XXXX, "m": "aws.lambda.enhanced.invocations", "t": ["region:sa-east-1", "account_id:XXXX", "functionname:python-integration-tests-XXXX-async-metrics_python27", "resource:python-integration-tests-XXXX-async-metrics_python27", "cold_start:true", "memorysize:1024", "runtime:python2.7", "datadog_lambda:vXX", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
+{"e": XXXX, "m": "aws.lambda.enhanced.invocations", "t": ["region:sa-east-1", "account_id:XXXX", "functionname:integration-tests-python-XXXX-async-metrics_python27", "resource:integration-tests-python-XXXX-async-metrics_python27", "cold_start:true", "memorysize:1024", "runtime:python2.7", "datadog_lambda:vXX", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
 {"e": XXXX, "m": "hello.dog", "t": ["team:serverless", "role:hello", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
 {"e": XXXX, "m": "tests.integration.count", "t": ["test:integration", "role:hello", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 21}
 HTTP GET https://httpstat.us/200/ Headers: ["Accept-Encoding:gzip, deflate", "Accept:*/*", "Connection:keep-alive", "User-Agent:python-requests/2.25.1", "x-datadog-parent-id:XXXX", "x-datadog-sampling-priority:1", "x-datadog-trace-id:XXXX"] Data: {}
 HTTP GET https://httpstat.us/400/ Headers: ["Accept-Encoding:gzip, deflate", "Accept:*/*", "Connection:keep-alive", "User-Agent:python-requests/2.25.1", "x-datadog-parent-id:XXXX", "x-datadog-sampling-priority:1", "x-datadog-trace-id:XXXX"] Data: {}
-{"traces": [[{"resource": "python-integration-tests-XXXX-async-metrics_python27", "name": "aws.lambda", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_sampling_priority_v1": 1, "system.pid": XXXX, "_dd.agent_psr": 1.0}, "parent_id": "XXXX", "meta": {"http.method": "GET", "runtime-id": "XXXX", "request_id": "XXXX", "function_trigger.event_source": "api-gateway", "cold_start": "true", "datadog_lambda": "X.X.X", "function_arn": "arn:aws:lambda:sa-east-1:601427279990:function:python-integration-tests-XXXX-async-metrics_python27", "dd_trace": "X.X.X", "_dd.origin": "lambda", "http.status_code": "200", "resource_names": "python-integration-tests-XXXX-async-metrics_python27", "function_trigger.event_source_arn": "arn:aws:apigateway:sa-east-1::/restapis/wt6mne2s9k/stages/test", "function_version": "$LATEST"}, "error": 0, "duration": XXXX, "type": "serverless", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "200", "http.url": "https://httpstat.us/200/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "400", "http.url": "https://httpstat.us/400/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}]]}
+{"traces": [[{"resource": "integration-tests-python-XXXX-async-metrics_python27", "name": "aws.lambda", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_sampling_priority_v1": 1, "system.pid": XXXX, "_dd.agent_psr": 1.0}, "parent_id": "XXXX", "meta": {"http.method": "GET", "runtime-id": "XXXX", "request_id": "XXXX", "function_trigger.event_source": "api-gateway", "cold_start": "true", "datadog_lambda": "X.X.X", "function_arn": "arn:aws:lambda:sa-east-1:601427279990:function:integration-tests-python-XXXX-async-metrics_python27", "dd_trace": "X.X.X", "_dd.origin": "lambda", "http.status_code": "200", "resource_names": "integration-tests-python-XXXX-async-metrics_python27", "function_trigger.event_source_arn": "arn:aws:apigateway:sa-east-1::/restapis/wt6mne2s9k/stages/test", "function_version": "$LATEST"}, "error": 0, "duration": XXXX, "type": "serverless", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "200", "http.url": "https://httpstat.us/200/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "400", "http.url": "https://httpstat.us/400/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}]]}
 END RequestId: XXXX
 REPORT RequestId: XXXX	Duration: XXXX ms	Billed Duration: XXXX ms	Memory Size: 1024 MB	Max Memory Used: XXXX MB	Init Duration: XXXX ms	
 START RequestId: XXXX Version: $LATEST
-{"e": XXXX, "m": "aws.lambda.enhanced.invocations", "t": ["region:sa-east-1", "account_id:XXXX", "functionname:python-integration-tests-XXXX-async-metrics_python27", "resource:python-integration-tests-XXXX-async-metrics_python27", "cold_start:false", "memorysize:1024", "runtime:python2.7", "datadog_lambda:vXX", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
+{"e": XXXX, "m": "aws.lambda.enhanced.invocations", "t": ["region:sa-east-1", "account_id:XXXX", "functionname:integration-tests-python-XXXX-async-metrics_python27", "resource:integration-tests-python-XXXX-async-metrics_python27", "cold_start:false", "memorysize:1024", "runtime:python2.7", "datadog_lambda:vXX", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
 {"e": XXXX, "m": "hello.dog", "t": ["team:serverless", "role:hello", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
 {"e": XXXX, "m": "tests.integration.count", "t": ["test:integration", "role:hello", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 21}
 HTTP GET https://httpstat.us/200/ Headers: ["Accept-Encoding:gzip, deflate", "Accept:*/*", "Connection:keep-alive", "User-Agent:python-requests/2.25.1", "x-datadog-parent-id:XXXX", "x-datadog-sampling-priority:1", "x-datadog-trace-id:XXXX"] Data: {}
 HTTP GET https://httpstat.us/400/ Headers: ["Accept-Encoding:gzip, deflate", "Accept:*/*", "Connection:keep-alive", "User-Agent:python-requests/2.25.1", "x-datadog-parent-id:XXXX", "x-datadog-sampling-priority:1", "x-datadog-trace-id:XXXX"] Data: {}
-{"traces": [[{"resource": "python-integration-tests-XXXX-async-metrics_python27", "name": "aws.lambda", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_sampling_priority_v1": 1, "system.pid": XXXX, "_dd.agent_psr": 1.0}, "parent_id": "XXXX", "meta": {"runtime-id": "XXXX", "request_id": "XXXX", "function_trigger.event_source": "sns", "cold_start": "false", "datadog_lambda": "X.X.X", "function_arn": "arn:aws:lambda:sa-east-1:601427279990:function:python-integration-tests-XXXX-async-metrics_python27", "dd_trace": "X.X.X", "_dd.origin": "lambda", "resource_names": "python-integration-tests-XXXX-async-metrics_python27", "function_trigger.event_source_arn": "arn:aws:sns:us-east-2:123456789012:sns-lambda", "function_version": "$LATEST"}, "error": 0, "duration": XXXX, "type": "serverless", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "200", "http.url": "https://httpstat.us/200/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "400", "http.url": "https://httpstat.us/400/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}]]}
+{"traces": [[{"resource": "integration-tests-python-XXXX-async-metrics_python27", "name": "aws.lambda", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_sampling_priority_v1": 1, "system.pid": XXXX, "_dd.agent_psr": 1.0}, "parent_id": "XXXX", "meta": {"runtime-id": "XXXX", "request_id": "XXXX", "function_trigger.event_source": "sns", "cold_start": "false", "datadog_lambda": "X.X.X", "function_arn": "arn:aws:lambda:sa-east-1:601427279990:function:integration-tests-python-XXXX-async-metrics_python27", "dd_trace": "X.X.X", "_dd.origin": "lambda", "resource_names": "integration-tests-python-XXXX-async-metrics_python27", "function_trigger.event_source_arn": "arn:aws:sns:us-east-2:123456789012:sns-lambda", "function_version": "$LATEST"}, "error": 0, "duration": XXXX, "type": "serverless", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "200", "http.url": "https://httpstat.us/200/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "400", "http.url": "https://httpstat.us/400/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}]]}
 END RequestId: XXXX
 REPORT RequestId: XXXX	Duration: XXXX ms	Billed Duration: XXXX ms	Memory Size: 1024 MB	Max Memory Used: XXXX MB	
 START RequestId: XXXX Version: $LATEST
-{"e": XXXX, "m": "aws.lambda.enhanced.invocations", "t": ["region:sa-east-1", "account_id:XXXX", "functionname:python-integration-tests-XXXX-async-metrics_python27", "resource:python-integration-tests-XXXX-async-metrics_python27", "cold_start:false", "memorysize:1024", "runtime:python2.7", "datadog_lambda:vXX", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
+{"e": XXXX, "m": "aws.lambda.enhanced.invocations", "t": ["region:sa-east-1", "account_id:XXXX", "functionname:integration-tests-python-XXXX-async-metrics_python27", "resource:integration-tests-python-XXXX-async-metrics_python27", "cold_start:false", "memorysize:1024", "runtime:python2.7", "datadog_lambda:vXX", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
 {"e": XXXX, "m": "hello.dog", "t": ["team:serverless", "role:hello", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 1}
 {"e": XXXX, "m": "tests.integration.count", "t": ["test:integration", "role:hello", "dd_lambda_layer:datadog-python27_X.X.X"], "v": 21}
 HTTP GET https://httpstat.us/200/ Headers: ["Accept-Encoding:gzip, deflate", "Accept:*/*", "Connection:keep-alive", "User-Agent:python-requests/2.25.1", "x-datadog-parent-id:XXXX", "x-datadog-sampling-priority:1", "x-datadog-trace-id:XXXX"] Data: {}
 HTTP GET https://httpstat.us/400/ Headers: ["Accept-Encoding:gzip, deflate", "Accept:*/*", "Connection:keep-alive", "User-Agent:python-requests/2.25.1", "x-datadog-parent-id:XXXX", "x-datadog-sampling-priority:1", "x-datadog-trace-id:XXXX"] Data: {}
-{"traces": [[{"resource": "python-integration-tests-XXXX-async-metrics_python27", "name": "aws.lambda", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_sampling_priority_v1": 1, "system.pid": XXXX}, "parent_id": "XXXX", "meta": {"runtime-id": "XXXX", "request_id": "XXXX", "function_trigger.event_source": "sqs", "cold_start": "false", "datadog_lambda": "X.X.X", "function_arn": "arn:aws:lambda:sa-east-1:601427279990:function:python-integration-tests-XXXX-async-metrics_python27", "dd_trace": "X.X.X", "_dd.origin": "lambda", "resource_names": "python-integration-tests-XXXX-async-metrics_python27", "function_trigger.event_source_arn": "arn:aws:sqs:us-east-2:123456789012:my-queue", "function_version": "$LATEST"}, "error": 0, "duration": XXXX, "type": "serverless", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "200", "http.url": "https://httpstat.us/200/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "400", "http.url": "https://httpstat.us/400/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}]]}
+{"traces": [[{"resource": "integration-tests-python-XXXX-async-metrics_python27", "name": "aws.lambda", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_sampling_priority_v1": 1, "system.pid": XXXX}, "parent_id": "XXXX", "meta": {"runtime-id": "XXXX", "request_id": "XXXX", "function_trigger.event_source": "sqs", "cold_start": "false", "datadog_lambda": "X.X.X", "function_arn": "arn:aws:lambda:sa-east-1:601427279990:function:integration-tests-python-XXXX-async-metrics_python27", "dd_trace": "X.X.X", "_dd.origin": "lambda", "resource_names": "integration-tests-python-XXXX-async-metrics_python27", "function_trigger.event_source_arn": "arn:aws:sqs:us-east-2:123456789012:my-queue", "function_version": "$LATEST"}, "error": 0, "duration": XXXX, "type": "serverless", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "200", "http.url": "https://httpstat.us/200/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}, {"resource": "requests.request", "name": "requests.request", "service": "aws.lambda", "start": XXXX, "trace_id": "XXXX", "metrics": {"_dd.measured": 1}, "parent_id": "XXXX", "meta": {"http.status_code": "400", "http.url": "https://httpstat.us/400/", "_dd.origin": "lambda", "http.method": "GET"}, "error": 0, "duration": XXXX, "type": "http", "span_id": "XXXX"}]]}
 END RequestId: XXXX
 REPORT RequestId: XXXX	Duration: XXXX ms	Billed Duration: XXXX ms	Memory Size: 1024 MB	Max Memory Used: XXXX MB