cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ansible/hacking/aws_config/testing_policies/compute-policy.json

278 lines
11 KiB
JSON
Raw Normal View History

Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
{# Not all Autoscaling API Actions allow specified resources #}
{# See http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources #}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DescribeAutoscaling",
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribePolicies"
],
"Resource": "*"
},
{
"Sid": "AllowAutoscaling",
"Effect": "Allow",
"Action": [
ec2_asg: fix the integration tests (#61212)
2019-08-23 20:53:47 +02:00
"autoscaling:*LaunchConfiguration",
"autoscaling:*AutoScalingGroup",
"autoscaling:*MetricsCollection",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"autoscaling:PutScalingPolicy",
"autoscaling:DeletePolicy"
],
"Resource": [
"arn:aws:autoscaling:{{aws_region}}:{{aws_account}}:*"
]
},
{# Note that not all EC2 API Actions allow a specific resource #}
{# See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions #}
{
"Sid": "AllowUnspecifiedEC2Resource",
"Effect": "Allow",
"Action": [
ec2_launch_template: Fix integration tests (#61260) * ec2_launch_template: (integration tests) make sure security_token is optional * ec2_launch_template: (integration tests) add dependencies at the top level so they're pulled into the docker containers * Update Hacking Compute Policies for Launch Templates
2019-09-04 21:33:01 +02:00
"ec2:*LaunchTemplate",
"ec2:*LaunchTemplateVersion",
"ec2:*LaunchTemplateVersions",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:AllocateAddress",
"ec2:AssociateAddress",
[cloud] ec2_vpc_net integration tests (#33111) * Add some integration tests for ec2_vpc_net module * Add a couple tests for check mode fix typo ensure the DHCP option set is cleaned up * Add permissions to test policy
2017-12-05 22:41:16 +01:00
"ec2:AssociateDhcpOptions",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:AssociateRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AssociateSubnetCidrBlock",
"ec2:AttachInternetGateway",
Fix ec2_instance eventual consistency when wait: false (#51885) * Do not return 'instances' when wait is false * Added integration tests for wait: false * Added changelog fragment * Fix test suite to work with ec2_instance * Additional permissions * Enforce boto3 version * Fix broken tests * Improve error messages * fix linter issues
2019-03-06 13:46:37 +01:00
"ec2:AttachNetworkInterface",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"ec2:AttachVolume",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:AttachVpnGateway",
"ec2:CreateCustomerGateway",
[cloud] ec2_vpc_net integration tests (#33111) * Add some integration tests for ec2_vpc_net module * Add a couple tests for check mode fix typo ensure the DHCP option set is cleaned up * Add permissions to test policy
2017-12-05 22:41:16 +01:00
"ec2:CreateDhcpOptions",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:CreateImage",
"ec2:CreateInternetGateway",
"ec2:CreateKeyPair",
"ec2:CreateNatGateway",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"ec2:CreateNetworkInterface",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSnapshot",
"ec2:CreateSubnet",
"ec2:CreateTags",
"ec2:CreateVpc",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:CreateVpnConnection",
"ec2:CreateVpnGateway",
"ec2:DeleteCustomerGateway",
[cloud] ec2_vpc_net integration tests (#33111) * Add some integration tests for ec2_vpc_net module * Add a couple tests for check mode fix typo ensure the DHCP option set is cleaned up * Add permissions to test policy
2017-12-05 22:41:16 +01:00
"ec2:DeleteDhcpOptions",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeleteInternetGateway",
"ec2:DeleteKeyPair",
"ec2:DeleteNatGateway",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"ec2:DeleteNetworkInterface",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSnapshot",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DeleteVpc",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:DeleteVpnConnection",
"ec2:DeleteVpnGateway",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeregisterImage",
"ec2:DetachInternetGateway",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:DetachVpnGateway",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:Describe*",
"ec2:DisassociateAddress",
"ec2:DisassociateRouteTable",
Add two missing VPC permissions (#37896) Remove VPC permissions from network-policy.json as they mostly duplicate compute-policy.json permissions - separating the VPC and compute permissions would likely lead to further confusion.
2018-05-25 12:31:54 +02:00
"ec2:DisassociateSubnetCidrBlock",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:ImportKeyPair",
"ec2:ModifyImageAttribute",
Fix ec2_instance eventual consistency when wait: false (#51885) * Do not return 'instances' when wait is false * Added integration tests for wait: false * Added changelog fragment * Fix test suite to work with ec2_instance * Additional permissions * Enforce boto3 version * Fix broken tests * Improve error messages * fix linter issues
2019-03-06 13:46:37 +01:00
"ec2:ModifyInstanceAttribute",
Add two missing VPC permissions (#37896) Remove VPC permissions from network-policy.json as they mostly duplicate compute-policy.json permissions - separating the VPC and compute permissions would likely lead to further confusion.
2018-05-25 12:31:54 +02:00
"ec2:ModifySubnetAttribute",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:ModifyVpcAttribute",
"ec2:RegisterImage",
"ec2:ReleaseAddress",
Ensure block device instance creation outputs instances Not waiting outputs results in a format that will never be matched by the tests Ensure instances get tidied up Allow ec2:ReportInstanceStatus ec2_instance: Improve test cleanup on failing tests Improve describe/modify attribute error handling Address feedback on PR
2019-06-28 12:28:47 +02:00
"ec2:ReplaceRouteTableAssociation",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"ec2:ReplaceIamInstanceProfileAssociation",
Ensure block device instance creation outputs instances Not waiting outputs results in a format that will never be matched by the tests Ensure instances get tidied up Allow ec2:ReportInstanceStatus ec2_instance: Improve test cleanup on failing tests Improve describe/modify attribute error handling Address feedback on PR
2019-06-28 12:28:47 +02:00
"ec2:ReportInstanceStatus"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
],
"Resource": "*"
},
{
"Sid": "AllowSpecifiedEC2Resource",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:CreateTags",
Port ec2_tag to boto3 (#39712) * Add volume manipulation to EC2 integration test policy * Port ec2_tag to boto3
2018-07-27 21:45:18 +02:00
"ec2:CreateVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
Port ec2_tag to boto3 (#39712) * Add volume manipulation to EC2 integration test policy * Port ec2_tag to boto3
2018-07-27 21:45:18 +02:00
"ec2:DeleteVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RunInstances",
Fix ec2_instance eventual consistency when wait: false (#51885) * Do not return 'instances' when wait is false * Added integration tests for wait: false * Added changelog fragment * Fix test suite to work with ec2_instance * Additional permissions * Enforce boto3 version * Fix broken tests * Improve error messages * fix linter issues
2019-03-06 13:46:37 +01:00
"ec2:StartInstances",
"ec2:StopInstances",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:TerminateInstances",
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
"ec2:UpdateSecurityGroupRuleDescriptionsEgress"
],
"Resource": [
"arn:aws:ec2:{{aws_region}}::image/*",
"arn:aws:ec2:{{aws_region}}:{{aws_account}}:*"
]
},
{# According to http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html #}
{# Resource level access control is not possible for the new ELB API (providing Application Load Balancer functionality #}
{# While it remains possible for the old API, there is no distinction of the Actions between old API and new API #}
{
"Sid": "AllowLoadBalancerOperations",
"Effect": "Allow",
"Action": [
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:AddTags",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:ConfigureHealthCheck",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:CreateListener",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerListeners",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:CreateRule",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancerListeners",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:DeleteRule",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:DeleteTargetGroup",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:DescribeInstanceHealth",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"elasticloadbalancing:DescribeLoadBalancer*",
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:DescribeTags",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer",
"elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:ModifyListener",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:ModifyLoadBalancerAttributes",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:ModifyRule",
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:RemoveTags"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
],
"Resource": "*"
},
{# Only certain lambda actions can be restricted to a specific resource #}
{# http://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html #}
{
"Sid": "AllowApiGateway",
"Effect": "Allow",
"Action": [
"apigateway:*"
],
"Resource": [
"arn:aws:apigateway:{{aws_region}}::/*"
]
},
{
"Sid": "AllowGetUserForLambdaCreation",
"Effect": "Allow",
"Action": [
"iam:GetUser"
],
"Resource": [
"arn:aws:iam::{{aws_account}}:user/ansible_integration_tests"
]
},
{
"Sid": "AllowLambdaManagementWithoutResource",
"Effect": "Allow",
"Action": [
"lambda:CreateEventSourceMapping",
"lambda:GetAccountSettings",
"lambda:GetEventSourceMapping",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"lambda:List*",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"lambda:TagResource",
"lambda:UntagResource"
],
"Resource": "*"
},
{
"Sid": "AllowLambdaManagementWithResource",
"Effect": "Allow",
"Action": [
"lambda:AddPermission",
"lambda:CreateAlias",
"lambda:CreateFunction",
"lambda:DeleteAlias",
"lambda:DeleteFunction",
"lambda:GetAlias",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:GetPolicy",
"lambda:InvokeFunction",
"lambda:PublishVersion",
"lambda:RemovePermission",
"lambda:UpdateAlias",
"lambda:UpdateEventSourceMapping",
"lambda:UpdateFunctionCode",
"lambda:UpdateFunctionConfiguration"
],
"Resource": "arn:aws:lambda:{{aws_region}}:{{aws_account}}:function:*"
},
{
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"Sid": "AllowRoleManagement",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"arn:aws:iam::{{aws_account}}:role/ansible_lambda_role",
"arn:aws:iam::{{aws_account}}:role/ecsInstanceRole",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"arn:aws:iam::{{aws_account}}:role/ec2InstanceRole",
aws_eks_cluster: New module for managing AWS EKS (#41183) * aws_eks: New module for managing AWS EKS aws_eks module is used for creating and removing EKS clusters. Includes full test suite and updates to IAM policies to enable it. * Clean up all security groups * appease shippable * Rename aws_eks module to aws_eks_cluster
2018-06-07 14:44:04 +02:00
"arn:aws:iam::{{aws_account}}:role/ecsServiceRole",
ecs_taskdefinition can absent without containers argument (#41398) * ecs_taskdefinition can absent without containers argument * add regression test for absent with arn * Add PassRole privilege for ecs_cluster to pass
2018-07-12 15:16:41 +02:00
"arn:aws:iam::{{aws_account}}:role/aws_eks_cluster_role",
"arn:aws:iam::{{aws_account}}:role/ecsTaskExecutionRole"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
]
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
},
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
{
"Sid": "AllowSESManagement",
"Effect": "Allow",
"Action": [
"ses:VerifyEmailIdentity",
"ses:DeleteIdentity",
"ses:GetIdentityVerificationAttributes",
"ses:GetIdentityNotificationAttributes",
"ses:VerifyDomainIdentity",
"ses:SetIdentityNotificationTopic",
"ses:SetIdentityHeadersInNotificationsEnabled",
[cloud]Add aws_ses_identity_policy module for managing SES sending policies (#36623) * Add aws_ses_identity_policy module for managing SES sending policies * Add option to AnsibleAWSModule for applying a retry decorator to all calls. * Add per-callsite opt in to retry behaviours in AnsibleAWSModule * Update aws_ses_identity_policy module to opt in to retries at all callsites. * Add test for aws_ses_identity_policy module with inline policy. * Remove implicit retrys on boto resources since they're not working yet.
2018-04-05 21:11:12 +02:00
"ses:SetIdentityFeedbackForwardingEnabled",
"ses:GetIdentityPolicies",
"ses:PutIdentityPolicy",
"ses:DeleteIdentityPolicy",
[AWS] ses rule set module for inbound email processing (#42781) * Add module ses_rule_set for Amazon SES * Update behaviours and naming to be consistent with other aws_ses_ modules. * Add global lock around tests using active rule sets to prevent intermittent test failures. * Fix deletion of rule sets so that we don't inactivate the active rule set when force deleting an inactive rule set.
2018-11-14 18:15:24 +01:00
"ses:ListIdentityPolicies",
"ses:SetIdentityFeedbackForwardingEnabled",
"ses:ListReceiptRuleSets",
"ses:DescribeReceiptRuleSet",
"ses:DescribeActiveReceiptRuleSet",
"ses:SetActiveReceiptRuleSet",
"ses:CreateReceiptRuleSet",
"ses:DeleteReceiptRuleSet"
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
],
"Resource": [
"*"
]
},
{
"Sid": "AllowSNSManagement",
"Effect": "Allow",
"Action": [
"SNS:CreateTopic",
"SNS:DeleteTopic",
"SNS:GetTopicAttributes",
sns_topic boto3 port (#39292) * Port sns_topic to boto3 and add tests
2018-08-24 03:04:18 +02:00
"SNS:ListSubscriptions",
"SNS:ListSubscriptionsByTopic",
"SNS:ListTopics",
"SNS:SetTopicAttributes",
"SNS:Subscribe",
"SNS:Unsubscribe"
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
],
"Resource": [
"*"
]
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
}
]
}
Reference in a new issue Copy permalink