cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ansible/hacking/aws_config/testing_policies/compute-policy.json

270 lines
9.9 KiB
JSON
Raw Normal View History

Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
{# Not all Autoscaling API Actions allow specified resources #}
{# See http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources #}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DescribeAutoscaling",
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribePolicies"
],
"Resource": "*"
},
{
"Sid": "AllowAutoscaling",
"Effect": "Allow",
"Action": [
ec2_asg: fix the integration tests (#61212)
2019-08-23 20:53:47 +02:00
"autoscaling:*LaunchConfiguration",
aws_asg: Fix idempotency when using tags and metrics (#61284) * Update AWS hacking policy to enable ASG Tagging management * aws_asg: Add tests for ASG Tagging (including idempotency) * aws_asg: ignore sort order when comparing tags on the ASG (fix idempotency) * ec2_asg: (integration tests) test for idempotency when managing metrics collection * ec2_asg: sort list of enabled metrics to ensure clean comparisons.
2019-09-06 21:48:40 +02:00
"autoscaling:*LoadBalancers",
ec2_asg: fix the integration tests (#61212)
2019-08-23 20:53:47 +02:00
"autoscaling:*AutoScalingGroup",
"autoscaling:*MetricsCollection",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"autoscaling:PutScalingPolicy",
aws_asg: Fix idempotency when using tags and metrics (#61284) * Update AWS hacking policy to enable ASG Tagging management * aws_asg: Add tests for ASG Tagging (including idempotency) * aws_asg: ignore sort order when comparing tags on the ASG (fix idempotency) * ec2_asg: (integration tests) test for idempotency when managing metrics collection * ec2_asg: sort list of enabled metrics to ensure clean comparisons.
2019-09-06 21:48:40 +02:00
"autoscaling:DeletePolicy",
"autoscaling:*Tags"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
],
"Resource": [
"arn:aws:autoscaling:{{aws_region}}:{{aws_account}}:*"
]
},
{# Note that not all EC2 API Actions allow a specific resource #}
{# See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions #}
{
"Sid": "AllowUnspecifiedEC2Resource",
"Effect": "Allow",
"Action": [
ec2_launch_template: Fix integration tests (#61260) * ec2_launch_template: (integration tests) make sure security_token is optional * ec2_launch_template: (integration tests) add dependencies at the top level so they're pulled into the docker containers * Update Hacking Compute Policies for Launch Templates
2019-09-04 21:33:01 +02:00
"ec2:*LaunchTemplate",
"ec2:*LaunchTemplateVersion",
"ec2:*LaunchTemplateVersions",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"ec2:AttachVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:CreateImage",
"ec2:CreateKeyPair",
"ec2:CreateSecurityGroup",
"ec2:CreateSnapshot",
"ec2:CreateTags",
"ec2:DeleteKeyPair",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeregisterImage",
"ec2:Describe*",
[aws] integration tests for ec2_vol (#66193)
2020-01-23 23:34:06 +01:00
"ec2:DetachVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:ImportKeyPair",
"ec2:ModifyImageAttribute",
Fix ec2_instance eventual consistency when wait: false (#51885) * Do not return 'instances' when wait is false * Added integration tests for wait: false * Added changelog fragment * Fix test suite to work with ec2_instance * Additional permissions * Enforce boto3 version * Fix broken tests * Improve error messages * fix linter issues
2019-03-06 13:46:37 +01:00
"ec2:ModifyInstanceAttribute",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:RegisterImage",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"ec2:ReplaceIamInstanceProfileAssociation",
Ensure block device instance creation outputs instances Not waiting outputs results in a format that will never be matched by the tests Ensure instances get tidied up Allow ec2:ReportInstanceStatus ec2_instance: Improve test cleanup on failing tests Improve describe/modify attribute error handling Address feedback on PR
2019-06-28 12:28:47 +02:00
"ec2:ReportInstanceStatus"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
],
"Resource": "*"
},
{
"Sid": "AllowSpecifiedEC2Resource",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:CreateTags",
Port ec2_tag to boto3 (#39712) * Add volume manipulation to EC2 integration test policy * Port ec2_tag to boto3
2018-07-27 21:45:18 +02:00
"ec2:CreateVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
Port ec2_tag to boto3 (#39712) * Add volume manipulation to EC2 integration test policy * Port ec2_tag to boto3
2018-07-27 21:45:18 +02:00
"ec2:DeleteVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RunInstances",
Fix ec2_instance eventual consistency when wait: false (#51885) * Do not return 'instances' when wait is false * Added integration tests for wait: false * Added changelog fragment * Fix test suite to work with ec2_instance * Additional permissions * Enforce boto3 version * Fix broken tests * Improve error messages * fix linter issues
2019-03-06 13:46:37 +01:00
"ec2:StartInstances",
"ec2:StopInstances",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:TerminateInstances",
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
"ec2:UpdateSecurityGroupRuleDescriptionsEgress"
],
"Resource": [
"arn:aws:ec2:{{aws_region}}::image/*",
"arn:aws:ec2:{{aws_region}}:{{aws_account}}:*"
]
},
{# According to http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html #}
{# Resource level access control is not possible for the new ELB API (providing Application Load Balancer functionality #}
{# While it remains possible for the old API, there is no distinction of the Actions between old API and new API #}
{
"Sid": "AllowLoadBalancerOperations",
"Effect": "Allow",
"Action": [
aws_asg: Fix idempotency when using tags and metrics (#61284) * Update AWS hacking policy to enable ASG Tagging management * aws_asg: Add tests for ASG Tagging (including idempotency) * aws_asg: ignore sort order when comparing tags on the ASG (fix idempotency) * ec2_asg: (integration tests) test for idempotency when managing metrics collection * ec2_asg: sort list of enabled metrics to ensure clean comparisons.
2019-09-06 21:48:40 +02:00
"elasticloadbalancing:*LoadBalancer",
"elasticloadbalancing:*LoadBalancers",
"elasticloadbalancing:*LoadBalancerListeners",
"elasticloadbalancing:*TargetGroup",
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:AddTags",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:ConfigureHealthCheck",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:CreateListener",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:CreateRule",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:DeleteListener",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:DeleteRule",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:DescribeInstanceHealth",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"elasticloadbalancing:DescribeLoadBalancer*",
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:DescribeTags",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:ModifyListener",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:ModifyLoadBalancerAttributes",
Add logic to handle multiple actions in an ALB listener rule, Fixes #41861 (#41975) * added logic to handle multiple actions in an ALB listener rule (#41861) * fix linting and pep8 issues * added test for multiple actions using OIDC authentication * added error messages related to old versions of botocore and multiple actions * fix action validation error checks (need to check the exception string) * added logic to make oidc configs idempotent (remove clientsecret for check) * modified TargetGroupName to TargetGroupArn substitution to account for multiple rule actions * refactored tests so that it can be run against different versions of botocore * fix runme.sh to refelct changes to cloud testsuite * add UseExistingClientSecret to oidc config (AWS api change) * remove tests for OIDC auth action; add tests for redirect and fixed-response * add in fixes from markuman and mjmayer * remove documentation for cognito integration (not sure how to test); added example config for fixed-response and redirect actions * renamed oidc/multiple action tests; leaving commented due to some AWS API changes * pep8 fix * more pep8 fixes * Restructure elb_application_lb test suite Move from runme.sh to virtualenv based roles Update policies to fix tests Don't log temp dir deletion, so many files in the diff!
2019-08-02 02:40:53 +02:00
"elasticloadbalancing:ModifyRule",
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:RemoveTags"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
],
"Resource": "*"
},
{# Only certain lambda actions can be restricted to a specific resource #}
{# http://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html #}
{
"Sid": "AllowApiGateway",
"Effect": "Allow",
"Action": [
"apigateway:*"
],
"Resource": [
"arn:aws:apigateway:{{aws_region}}::/*"
]
},
{
"Sid": "AllowGetUserForLambdaCreation",
"Effect": "Allow",
"Action": [
"iam:GetUser"
],
"Resource": [
"arn:aws:iam::{{aws_account}}:user/ansible_integration_tests"
]
},
{
"Sid": "AllowLambdaManagementWithoutResource",
"Effect": "Allow",
"Action": [
"lambda:CreateEventSourceMapping",
"lambda:GetAccountSettings",
"lambda:GetEventSourceMapping",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"lambda:List*",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"lambda:TagResource",
"lambda:UntagResource"
],
"Resource": "*"
},
{
"Sid": "AllowLambdaManagementWithResource",
"Effect": "Allow",
"Action": [
"lambda:AddPermission",
"lambda:CreateAlias",
"lambda:CreateFunction",
"lambda:DeleteAlias",
"lambda:DeleteFunction",
"lambda:GetAlias",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:GetPolicy",
"lambda:InvokeFunction",
"lambda:PublishVersion",
"lambda:RemovePermission",
"lambda:UpdateAlias",
"lambda:UpdateEventSourceMapping",
"lambda:UpdateFunctionCode",
"lambda:UpdateFunctionConfiguration"
],
"Resource": "arn:aws:lambda:{{aws_region}}:{{aws_account}}:function:*"
},
{
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"Sid": "AllowRoleManagement",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"arn:aws:iam::{{aws_account}}:role/ansible_lambda_role",
"arn:aws:iam::{{aws_account}}:role/ecsInstanceRole",
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
2019-07-04 21:25:19 +02:00
"arn:aws:iam::{{aws_account}}:role/ec2InstanceRole",
aws_eks_cluster: New module for managing AWS EKS (#41183) * aws_eks: New module for managing AWS EKS aws_eks module is used for creating and removing EKS clusters. Includes full test suite and updates to IAM policies to enable it. * Clean up all security groups * appease shippable * Rename aws_eks module to aws_eks_cluster
2018-06-07 14:44:04 +02:00
"arn:aws:iam::{{aws_account}}:role/ecsServiceRole",
ecs_taskdefinition can absent without containers argument (#41398) * ecs_taskdefinition can absent without containers argument * add regression test for absent with arn * Add PassRole privilege for ecs_cluster to pass
2018-07-12 15:16:41 +02:00
"arn:aws:iam::{{aws_account}}:role/aws_eks_cluster_role",
"arn:aws:iam::{{aws_account}}:role/ecsTaskExecutionRole"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
]
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
},
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
{
"Sid": "AllowSESManagement",
"Effect": "Allow",
"Action": [
"ses:VerifyEmailIdentity",
"ses:DeleteIdentity",
"ses:GetIdentityVerificationAttributes",
"ses:GetIdentityNotificationAttributes",
"ses:VerifyDomainIdentity",
"ses:SetIdentityNotificationTopic",
"ses:SetIdentityHeadersInNotificationsEnabled",
[cloud]Add aws_ses_identity_policy module for managing SES sending policies (#36623) * Add aws_ses_identity_policy module for managing SES sending policies * Add option to AnsibleAWSModule for applying a retry decorator to all calls. * Add per-callsite opt in to retry behaviours in AnsibleAWSModule * Update aws_ses_identity_policy module to opt in to retries at all callsites. * Add test for aws_ses_identity_policy module with inline policy. * Remove implicit retrys on boto resources since they're not working yet.
2018-04-05 21:11:12 +02:00
"ses:SetIdentityFeedbackForwardingEnabled",
"ses:GetIdentityPolicies",
"ses:PutIdentityPolicy",
"ses:DeleteIdentityPolicy",
[AWS] ses rule set module for inbound email processing (#42781) * Add module ses_rule_set for Amazon SES * Update behaviours and naming to be consistent with other aws_ses_ modules. * Add global lock around tests using active rule sets to prevent intermittent test failures. * Fix deletion of rule sets so that we don't inactivate the active rule set when force deleting an inactive rule set.
2018-11-14 18:15:24 +01:00
"ses:ListIdentityPolicies",
"ses:SetIdentityFeedbackForwardingEnabled",
"ses:ListReceiptRuleSets",
"ses:DescribeReceiptRuleSet",
"ses:DescribeActiveReceiptRuleSet",
"ses:SetActiveReceiptRuleSet",
"ses:CreateReceiptRuleSet",
"ses:DeleteReceiptRuleSet"
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
],
"Resource": [
"*"
]
},
{
"Sid": "AllowSNSManagement",
"Effect": "Allow",
"Action": [
"SNS:CreateTopic",
"SNS:DeleteTopic",
"SNS:GetTopicAttributes",
sns_topic boto3 port (#39292) * Port sns_topic to boto3 and add tests
2018-08-24 03:04:18 +02:00
"SNS:ListSubscriptions",
"SNS:ListSubscriptionsByTopic",
"SNS:ListTopics",
"SNS:SetTopicAttributes",
"SNS:Subscribe",
"SNS:Unsubscribe"
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
],
"Resource": [
"*"
]
New module for AWS Step Functions state machines (#59116) * add new module: aws_stepfunctions_state_machine * add integration tests for new module: aws_stepfunctions_state_machine * fix sanity checks * use files/ folder instead for integration test * rename role name in integration test * attempt further permissions * iam states prefix * iam integration test prefix * add iam policy for running step functions state machine actions * slightly increase iam permission scope * rename integration test folder to proper name * move main() method to end of file * move contents of integration-policy.json for state machines to compute-policy.json * make check_mode return proper changed value + add check_mode integration tests * rename module to aws_step_functions_state_machine * fix missed rename in integration test variable * add purge_tags option * bump to version 2.10
2019-09-09 19:08:21 +02:00
},
{
"Sid": "AllowStepFunctionsStateMachine",
"Effect": "Allow",
"Action": [
"states:CreateStateMachine",
"states:DeleteStateMachine",
add module aws_step_functions_state_machine_execution (#64431) * add module aws_step_functions_state_machine_execution * AWS step functions tests - Use module defaults * Return all attributes from aws api calls as ansible task output * aws_sfn - make start and stop execution idempotent and fix check mode * aws sfn - use build_full_result method of the paginator * aws sfn - remove changes made to help with local debugging
2019-12-10 20:08:49 +01:00
"states:DescribeExecution",
New module for AWS Step Functions state machines (#59116) * add new module: aws_stepfunctions_state_machine * add integration tests for new module: aws_stepfunctions_state_machine * fix sanity checks * use files/ folder instead for integration test * rename role name in integration test * attempt further permissions * iam states prefix * iam integration test prefix * add iam policy for running step functions state machine actions * slightly increase iam permission scope * rename integration test folder to proper name * move main() method to end of file * move contents of integration-policy.json for state machines to compute-policy.json * make check_mode return proper changed value + add check_mode integration tests * rename module to aws_step_functions_state_machine * fix missed rename in integration test variable * add purge_tags option * bump to version 2.10
2019-09-09 19:08:21 +02:00
"states:DescribeStateMachine",
add module aws_step_functions_state_machine_execution (#64431) * add module aws_step_functions_state_machine_execution * AWS step functions tests - Use module defaults * Return all attributes from aws api calls as ansible task output * aws_sfn - make start and stop execution idempotent and fix check mode * aws sfn - use build_full_result method of the paginator * aws sfn - remove changes made to help with local debugging
2019-12-10 20:08:49 +01:00
"states:ListExecutions",
New module for AWS Step Functions state machines (#59116) * add new module: aws_stepfunctions_state_machine * add integration tests for new module: aws_stepfunctions_state_machine * fix sanity checks * use files/ folder instead for integration test * rename role name in integration test * attempt further permissions * iam states prefix * iam integration test prefix * add iam policy for running step functions state machine actions * slightly increase iam permission scope * rename integration test folder to proper name * move main() method to end of file * move contents of integration-policy.json for state machines to compute-policy.json * make check_mode return proper changed value + add check_mode integration tests * rename module to aws_step_functions_state_machine * fix missed rename in integration test variable * add purge_tags option * bump to version 2.10
2019-09-09 19:08:21 +02:00
"states:ListStateMachines",
"states:ListTagsForResource",
add module aws_step_functions_state_machine_execution (#64431) * add module aws_step_functions_state_machine_execution * AWS step functions tests - Use module defaults * Return all attributes from aws api calls as ansible task output * aws_sfn - make start and stop execution idempotent and fix check mode * aws sfn - use build_full_result method of the paginator * aws sfn - remove changes made to help with local debugging
2019-12-10 20:08:49 +01:00
"states:StartExecution",
"states:StopExecution",
New module for AWS Step Functions state machines (#59116) * add new module: aws_stepfunctions_state_machine * add integration tests for new module: aws_stepfunctions_state_machine * fix sanity checks * use files/ folder instead for integration test * rename role name in integration test * attempt further permissions * iam states prefix * iam integration test prefix * add iam policy for running step functions state machine actions * slightly increase iam permission scope * rename integration test folder to proper name * move main() method to end of file * move contents of integration-policy.json for state machines to compute-policy.json * make check_mode return proper changed value + add check_mode integration tests * rename module to aws_step_functions_state_machine * fix missed rename in integration test variable * add purge_tags option * bump to version 2.10
2019-09-09 19:08:21 +02:00
"states:TagResource",
"states:UntagResource",
"states:UpdateStateMachine"
],
"Resource": [
Fix hacking policy (#67579)
2020-02-19 18:05:43 +01:00
"arn:aws:states:*:*:*"
New module for AWS Step Functions state machines (#59116) * add new module: aws_stepfunctions_state_machine * add integration tests for new module: aws_stepfunctions_state_machine * fix sanity checks * use files/ folder instead for integration test * rename role name in integration test * attempt further permissions * iam states prefix * iam integration test prefix * add iam policy for running step functions state machine actions * slightly increase iam permission scope * rename integration test folder to proper name * move main() method to end of file * move contents of integration-policy.json for state machines to compute-policy.json * make check_mode return proper changed value + add check_mode integration tests * rename module to aws_step_functions_state_machine * fix missed rename in integration test variable * add purge_tags option * bump to version 2.10
2019-09-09 19:08:21 +02:00
]
Add integration tests for aws lightsail (#63770) * Add integration tests for aws lightsail * lightsail - use module_defaults instead of aws_connection_info * lightsail tests - assert instance state on create * Fix yaml syntax error Co-Authored-By: Jill R <4121322+jillr@users.noreply.github.com> * [lightsail] create keypair as part of the testsuite * Fix lightsail actions in compute-policy * Add ability to delete keypair in lightsail_keypair
2019-11-22 00:53:36 +01:00
},
{
"Sid": "AllowLightsail",
"Effect": "Allow",
"Action": [
"lightsail:CreateInstances",
"lightsail:DeleteInstance",
"lightsail:GetInstance",
"lightsail:GetInstances",
"lightsail:RebootInstance",
"lightsail:StartInstance",
"lightsail:StopInstance"
],
"Resource": "arn:aws:lightsail:*:*:*"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
}
]
}
Reference in a new issue Copy permalink