def lambda_role()

in getting_started/utility.py [0:0]
73 lines of code
5 McCabe index (conditional complexity)

def lambda_role(bucket_arn,L4M_AnomalyDetectorArn):
    l4m = boto3.client('lookoutmetrics')
    response = l4m.list_metric_sets(
    AnomalyDetectorArn=L4M_AnomalyDetectorArn,
    )
    iam = boto3.client('iam')
    bucket_arn=bucket_arn+"*"
    role_name_lambda= 'L4M_visualization_lambda'
    assume_role_policy_document_lambda = {
        "Version": "2012-10-17",
        "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
        ]
    }
    try:
        create_role_response = iam.create_role(
            RoleName = role_name_lambda,
            AssumeRolePolicyDocument = json.dumps(assume_role_policy_document_lambda)
        );

    except iam.exceptions.EntityAlreadyExistsException as e:
        print('Warning: role already exists:', e)
        create_role_response = iam.get_role(
            RoleName = role_name_lambda
        );
    role_arn = create_role_response["Role"]["Arn"]
    print('IAM Role: {}'.format(role_arn))

    policy_json={
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:listBucket"
                ],
                "Resource": [
                    bucket_arn
                ]
            },
            {
                "Effect": "Allow",
                "Action": "lookoutmetrics:DescribeMetricSet",
                "Resource": response['MetricSetSummaryList'][0]['MetricSetArn']
            }#,
            #{
            #    "Effect": "Allow",
            #    "Action": "logs:CreateLogGroup",
            #    "Resource": "arn:aws:logs:us-east-1:165810815517:*"
            #},
            #{
            #    "Effect": "Allow",
            #    "Action": [
            #        "logs:CreateLogStream",
            #        "logs:PutLogEvents"
            #    ],
            #    "Resource": [
            #        "arn:aws:logs:us-east-1:165810815517:log-group:/aws/lambda/L4M:*"
             #   ]
            #}
        ]
    }
    
    try:
        create_policy = iam.create_policy(
            PolicyName = 'AccessLambdaForS3forL4M',
            PolicyDocument = json.dumps(policy_json)
        );

    except iam.exceptions.EntityAlreadyExistsException as e:
        print('Warning: role already exists:', e)
        response = iam.list_policies()
        s= response['Policies']
        my_policy = next((item for item in s if item['PolicyName'] == 'AccessLambdaForS3forL4M'), None)
        create_policy = iam.get_policy(
            PolicyArn = my_policy['Arn']
        );

    policy_arn = create_policy["Policy"]["Arn"]
    print('IAM Policy: {}'.format(policy_arn))

    attach_response = iam.attach_role_policy(
        RoleName = role_name_lambda,
        PolicyArn = policy_arn
    );
    return (role_name_lambda, role_arn,policy_arn)