cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ansible/hacking/aws_config/testing_policies/network-policy.json

118 lines
4.3 KiB
JSON
Raw Normal View History

route53_zone: move to boto3, and enable comment update (#36641)
2018-03-07 17:16:04 +01:00
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ManageRoute53ForTests",
"Effect": "Allow",
"Action": [
"route53:CreateHostedZone",
Update Route53 IAM policy so the Route53 tests run (#64886)
2019-11-18 14:48:59 +01:00
"route53:ChangeResourceRecordSets",
route53_zone: move to boto3, and enable comment update (#36641)
2018-03-07 17:16:04 +01:00
"route53:DeleteHostedZone",
"route53:GetHostedZone",
"route53:ListHostedZones",
Update Route53 IAM policy so the Route53 tests run (#64886)
2019-11-18 14:48:59 +01:00
"route53:ListResourceRecordSets",
route53_zone: move to boto3, and enable comment update (#36641)
2018-03-07 17:16:04 +01:00
"route53:UpdateHostedZoneComment"
],
"Resource": "*"
AWS: new module ec2_transit_gateway fixes #49376 (#53651) * AWS: new module ec2_transit_gateway fixes #49376 * Add permissions neeeded for integration tests * uncomment nolog on creds * add unsupported to integration test aliases * remove the shippable/aws/group alias so doesn't conflict with unsupported
2019-03-14 00:42:33 +01:00
},
ec2_eip Don't throw an exception when re-releasing an EIP (idempotency) (#62332) * ec2_eip: (integration tests) move to using module_defaults * ec2_eip: (integration tests) expand integration tests Also clean up a little - Delete EIPs when we finish testing them (reduce the chance of hitting limits) - Rejig deletion so that it works when runs fail - Add tests for ec2_eip_info * ec2_eip: Minor doc tweaks * ec2_eip: Don't throw an exception when we try to disassociate an already disassociated EIP * ec2_eip: Add missing IAM policy (manage IGWs) * ec2_eip: (integration tests) Use the VPC as a crude lock to avoid running parallel tests We test that untagged EIPs come and go as we expect, if multiple tests are running in parallel this confuses things * Fix ec2_eip association
2019-11-13 21:27:35 +01:00
{
"Sid": "AllowInternetGatewayManagement",
"Effect": "Allow",
"Action": [
"ec2:CreateInternetGateway",
"ec2:DeleteInternetGateway",
"ec2:DescribeInternetGateways"
],
"Resource": "*"
},
AWS: new module ec2_transit_gateway fixes #49376 (#53651) * AWS: new module ec2_transit_gateway fixes #49376 * Add permissions neeeded for integration tests * uncomment nolog on creds * add unsupported to integration test aliases * remove the shippable/aws/group alias so doesn't conflict with unsupported
2019-03-14 00:42:33 +01:00
{
"Sid": "AllowTransitGatewayManagement",
"Effect": "Allow",
"Action": [
"ec2:CreateTransitGateway",
"ec2:DeleteTransitGateway",
"ec2:DescribeTransitGateways"
],
"Resource": "*"
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
},
ec2_vpc_nacl and ec2_vpc_nacl_info migrate to AnsibleAWSModule and add tests (#63163) * Move EC2 networking objects into network-policy.json * ec2_vpc_nacl: Add integration tests * ec2_vpc_nacl: Migrate tests to use module_defaults * ec2_vpc_nacl: (integration tests) Add missing AWS permissions * ec2_vpc_nacl: (integration tests) Update tests for ipv6 support * ec2_vpc_nacl: Migrate to AnsibleAWSModule * Fix sanity tests for ec2_vpc_nacl and ec2_vpc_nacl_info * ec2_vpc_nacl_info: Migrate to AnsibleAWSModule * ec2_vpc_nacl_info: (integration tests) Rename from ec2_vpc_nacl_facts to ec2_vpc_nacl_info and add a test using a filter (by tag) * Pick availability zones dynamically Rather than assuming that AZa and AZb always exist (they don't), query to find out which AZs we have available first * Test that the NACLs we get back are actually the *saml* NACL rather than duplicates/delete remove * Cleanup IPv6 tests a little. Note: IPv6 support for ec2_vpc_nacl not complete yet. This provides the initial framework, and should ensure things don't start exploding when support is added. * Removing subnets by name from a NACL *is* now supported * Fix ec2_vpc_nacl return documentation
2019-10-08 22:27:25 +02:00
{
"Sid": "AllowUnspecifiedEC2NetworkingResource",
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress",
"ec2:AssociateAddress",
"ec2:AssociateDhcpOptions",
"ec2:AssociateRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AssociateSubnetCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachNetworkInterface",
"ec2:AttachVpnGateway",
"ec2:CreateCustomerGateway",
"ec2:CreateDhcpOptions",
"ec2:CreateNatGateway",
"ec2:CreateNetworkAcl",
"ec2:CreateNetworkAclEntry",
"ec2:CreateNetworkInterface",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:CreateVpnConnection",
"ec2:CreateVpnGateway",
"ec2:DeleteCustomerGateway",
"ec2:DeleteDhcpOptions",
"ec2:DeleteInternetGateway",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkAclEntry",
"ec2:DeleteNetworkInterface",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DeleteVpc",
"ec2:DeleteVpnConnection",
"ec2:DeleteVpnGateway",
"ec2:DetachInternetGateway",
"ec2:DetachVpnGateway",
"ec2:Describe*",
"ec2:DisassociateAddress",
"ec2:DisassociateRouteTable",
"ec2:DisassociateSubnetCidrBlock",
ec2_vpc_net_info: integration tests (#62649) * ec2_vpc_net: (integration tests) migrate to using module_defaults * ec2_vpc_net: (integration tests) use a private subnet for the tests * ec2_vpc_net_info: Add integration tests * ec2_vpc_net_info: add cidr_block_association_set to documentation * Update AWS hacking test policy to allow VPC CIDR disassociation * Update test/integration/targets/ec2_vpc_net/tasks/main.yml Co-Authored-By: Jill R <4121322+jillr@users.noreply.github.com> * Store vpc2 ID to make it clearer which VPC we're changing * Be more consistent with our quoting * Explicitly test that the VPC IDs haven't changed
2019-11-14 21:36:42 +01:00
"ec2:DisassociateVpcCidrBlock",
ec2_vpc_nacl and ec2_vpc_nacl_info migrate to AnsibleAWSModule and add tests (#63163) * Move EC2 networking objects into network-policy.json * ec2_vpc_nacl: Add integration tests * ec2_vpc_nacl: Migrate tests to use module_defaults * ec2_vpc_nacl: (integration tests) Add missing AWS permissions * ec2_vpc_nacl: (integration tests) Update tests for ipv6 support * ec2_vpc_nacl: Migrate to AnsibleAWSModule * Fix sanity tests for ec2_vpc_nacl and ec2_vpc_nacl_info * ec2_vpc_nacl_info: Migrate to AnsibleAWSModule * ec2_vpc_nacl_info: (integration tests) Rename from ec2_vpc_nacl_facts to ec2_vpc_nacl_info and add a test using a filter (by tag) * Pick availability zones dynamically Rather than assuming that AZa and AZb always exist (they don't), query to find out which AZs we have available first * Test that the NACLs we get back are actually the *saml* NACL rather than duplicates/delete remove * Cleanup IPv6 tests a little. Note: IPv6 support for ec2_vpc_nacl not complete yet. This provides the initial framework, and should ensure things don't start exploding when support is added. * Removing subnets by name from a NACL *is* now supported * Fix ec2_vpc_nacl return documentation
2019-10-08 22:27:25 +02:00
"ec2:ModifySubnetAttribute",
"ec2:ModifyVpcAttribute",
"ec2:ReleaseAddress",
"ec2:ReplaceNetworkAclAssociation",
"ec2:ReplaceNetworkAclEntry",
"ec2:ReplaceRouteTableAssociation"
],
"Resource": "*"
},
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
{
"Sid": "AllowCloudfrontUsage",
"Effect": "Allow",
"Action": [
"cloudfront:CreateDistribution",
"cloudfront:CreateDistributionWithTags",
"cloudfront:CreateCloudFrontOriginAccessIdentity",
"cloudfront:DeleteDistribution",
"cloudfront:GetDistribution",
"cloudfront:GetStreamingDistribution",
"cloudfront:GetDistributionConfig",
"cloudfront:GetStreamingDistributionConfig",
"cloudfront:GetInvalidation",
"cloudfront:ListDistributions",
"cloudfront:ListDistributionsByWebACLId",
"cloudfront:ListInvalidations",
"cloudfront:ListStreamingDistributions",
"cloudfront:ListTagsForResource",
"cloudfront:TagResource",
"cloudfront:UntagResource",
"cloudfront:UpdateDistribution"
],
"Resource": "*"
route53_zone: move to boto3, and enable comment update (#36641)
2018-03-07 17:16:04 +01:00
}
]
}
Reference in a new issue Copy permalink