cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ansible/hacking/aws_config/testing_policies/database-policy.json

103 lines
3.2 KiB
JSON
Raw Normal View History

Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
{
"Version": "2012-10-17",
"Statement": [
{
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"Action": "iam:CreateServiceLinkedRole",
"Effect": "Allow",
"Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
"Condition": {
"StringLike": {
"iam:AWSServiceName":"rds.amazonaws.com"
}
}
},
{
"Sid": "AllowRDSReadEverywhere",
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
"Effect": "Allow",
"Action": [
"rds:ListTagsForResource",
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"rds:DescribeDBInstances",
"rds:DescribeDBParameterGroups",
"rds:DescribeDBParameters",
"rds:DescribeDBSnapshots"
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
],
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"Resource": ["*"]
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
},
{
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"Sid": "AllowRDSModuleTests",
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
"Effect": "Allow",
"Action": [
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"rds:AddTagsToResource",
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
"rds:CreateDBInstance",
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"rds:DeleteDBInstance",
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
"rds:ModifyDBInstance",
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"rds:PromoteReadReplica",
"rds:RebootDBInstance",
"rds:RemoveTagsFromResource",
"rds:StartDBInstance",
"rds:StopDBInstance"
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
],
"Resource": [
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"arn:aws:rds:{{aws_region}}:{{aws_account}}:db:ansible-test*"
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
]
},
{
"Sid": "AllowRDSSnapshotManageSnapshots",
"Effect": "Allow",
"Action": [
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"rds:AddTagsToResource",
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
"rds:CreateDBSnapshot",
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"rds:DeleteDBInstance",
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
"rds:DeleteDBSnapshot",
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"rds:RemoveTagsFromResource",
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
"rds:RestoreDBInstanceFromDBSnapshot",
"rds:CreateDBInstanceReadReplica"
],
"Resource": [
Fix RDS test suite and minor bugs revealed (#57940) * Update testing policy to be correct for RDS test suite * Create read replica in same region to avoid more permissions being required * Ensure modifying DB doesn't try to downgrade engine version * Add tags to main test suite to limit number of tests run for problem solving
2019-06-25 15:54:03 +02:00
"arn:aws:rds:{{aws_region}}:{{aws_account}}:snapshot:ansible-test*",
"arn:aws:rds:{{aws_region}}:{{aws_account}}:db:ansible-test*"
]
[cloud] Update RDS parameter group for boto3 (#25345) * Update RDS parameter group for boto3 * Update to boto3 * Update to latest ansible standards * Remove choices list for valid engines (See #19221 for context) * Allow tagging * Return some useful information, and document that information * Add tests for rds_param_group * Improve testing of rds_param_group * Add purge_tags option for rds_param_group * Fix remaining broken rds_param_group tests * Ensure the group name is lowercased. Fixes integration tests when run on OSX
2017-08-28 18:52:22 +02:00
},
{
"Sid": "AllowRDSParameterGroupManagement",
"Effect": "Allow",
"Action": [
"rds:CreateDBParameterGroup",
"rds:DeleteDBParameterGroup",
"rds:ModifyDBParameterGroup",
"rds:AddTagsToResource",
"rds:RemoveTagsFromResource"
],
"Resource": [
"arn:aws:rds:{{aws_region}}:{{aws_account}}:pg:*"
]
ecs_cluster test suite refactor (#57716) * Combine testing policies Because of the maximum of 10 policies per group, need to consolidate testing policies as best we can. * Tidy put-account-setting tasks and add permission Using `environment` and `command` rather than `shell` avoids the need for `no_log` and means that people can fix the problem * refactor ecs_cluster test suite move from runme.sh technique to virtualenv use ec2_instance rather than ec2 module to avoid need for boto
2019-06-17 20:41:20 +02:00
},
{
"Sid": "AllowRedshiftManagment",
"Action": [
"redshift:CreateCluster",
"redshift:CreateTags",
"redshift:DeleteCluster",
"redshift:DeleteTags",
"redshift:DescribeClusters",
"redshift:DescribeTags",
"redshift:ModifyCluster",
"redshift:RebootCluster"
],
"Effect": "Allow",
"Resource": "*"
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
},
{
"Sid": "DMSEndpoints",
"Effect": "Allow",
"Action": [
"dms:CreateEndpoint",
"dms:DeleteEndpoint",
"dms:DescribeEndpoints",
"dms:ModifyEndpoint"
],
"Resource": ["*"]
Split up testing IAM policies and automate creating them (#26223) * Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
2017-07-14 06:50:55 +02:00
}
]
}
Reference in a new issue Copy permalink