cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ansible/hacking/aws_config/testing_policies/compute-policy.json

263 lines
10 KiB
JSON
Raw Normal View History

Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
{# Not all Autoscaling API Actions allow specified resources #}
{# See http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources #}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DescribeAutoscaling",
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribePolicies"
],
"Resource": "*"
},
{
"Sid": "AllowAutoscaling",
"Effect": "Allow",
"Action": [
"autoscaling:CreateLaunchConfiguration",
"autoscaling:CreateAutoScalingGroup",
"autoscaling:UpdateAutoScalingGroup",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:DeleteLaunchConfiguration",
"autoscaling:PutScalingPolicy",
"autoscaling:DeletePolicy"
],
"Resource": [
"arn:aws:autoscaling:{{aws_region}}:{{aws_account}}:*"
]
},
{# Note that not all EC2 API Actions allow a specific resource #}
{# See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions #}
{
"Sid": "AllowUnspecifiedEC2Resource",
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress",
"ec2:AssociateAddress",
[cloud] ec2_vpc_net integration tests (#33111) * Add some integration tests for ec2_vpc_net module * Add a couple tests for check mode fix typo ensure the DHCP option set is cleaned up * Add permissions to test policy
2017-12-05 22:41:16 +01:00
"ec2:AssociateDhcpOptions",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:AssociateRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:AssociateSubnetCidrBlock",
"ec2:AttachInternetGateway",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:AttachVpnGateway",
"ec2:CreateCustomerGateway",
[cloud] ec2_vpc_net integration tests (#33111) * Add some integration tests for ec2_vpc_net module * Add a couple tests for check mode fix typo ensure the DHCP option set is cleaned up * Add permissions to test policy
2017-12-05 22:41:16 +01:00
"ec2:CreateDhcpOptions",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:CreateImage",
"ec2:CreateInternetGateway",
"ec2:CreateKeyPair",
"ec2:CreateNatGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSnapshot",
"ec2:CreateSubnet",
"ec2:CreateTags",
"ec2:CreateVpc",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:CreateVpnConnection",
"ec2:CreateVpnGateway",
"ec2:DeleteCustomerGateway",
[cloud] ec2_vpc_net integration tests (#33111) * Add some integration tests for ec2_vpc_net module * Add a couple tests for check mode fix typo ensure the DHCP option set is cleaned up * Add permissions to test policy
2017-12-05 22:41:16 +01:00
"ec2:DeleteDhcpOptions",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeleteInternetGateway",
"ec2:DeleteKeyPair",
"ec2:DeleteNatGateway",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSnapshot",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DeleteVpc",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:DeleteVpnConnection",
"ec2:DeleteVpnGateway",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeregisterImage",
"ec2:DetachInternetGateway",
New Module: ec2_vpc_vpn_facts (#35983) * New module: ec2_vpc_vpn_facts * Add integration tests for ec2_vpc_vpn_facts and the IAM permissions * Add retry to VPC removal * Use unique name for VGW * Always clean up after tests and add retries
2018-05-15 18:13:46 +02:00
"ec2:DetachVpnGateway",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:Describe*",
"ec2:DisassociateAddress",
"ec2:DisassociateRouteTable",
Add two missing VPC permissions (#37896) Remove VPC permissions from network-policy.json as they mostly duplicate compute-policy.json permissions - separating the VPC and compute permissions would likely lead to further confusion.
2018-05-25 12:31:54 +02:00
"ec2:DisassociateSubnetCidrBlock",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:ImportKeyPair",
"ec2:ModifyImageAttribute",
Add two missing VPC permissions (#37896) Remove VPC permissions from network-policy.json as they mostly duplicate compute-policy.json permissions - separating the VPC and compute permissions would likely lead to further confusion.
2018-05-25 12:31:54 +02:00
"ec2:ModifySubnetAttribute",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:ModifyVpcAttribute",
"ec2:RegisterImage",
"ec2:ReleaseAddress",
"ec2:ReplaceRouteTableAssociation"
],
"Resource": "*"
},
{
"Sid": "AllowSpecifiedEC2Resource",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:CreateTags",
Port ec2_tag to boto3 (#39712) * Add volume manipulation to EC2 integration test policy * Port ec2_tag to boto3
2018-07-27 21:45:18 +02:00
"ec2:CreateVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
Port ec2_tag to boto3 (#39712) * Add volume manipulation to EC2 integration test policy * Port ec2_tag to boto3
2018-07-27 21:45:18 +02:00
"ec2:DeleteVolume",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RunInstances",
"ec2:TerminateInstances",
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
"ec2:UpdateSecurityGroupRuleDescriptionsEgress"
],
"Resource": [
"arn:aws:ec2:{{aws_region}}::image/*",
"arn:aws:ec2:{{aws_region}}:{{aws_account}}:*"
]
},
{# According to http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html #}
{# Resource level access control is not possible for the new ELB API (providing Application Load Balancer functionality #}
{# While it remains possible for the old API, there is no distinction of the Actions between old API and new API #}
{
"Sid": "AllowLoadBalancerOperations",
"Effect": "Allow",
"Action": [
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:AddTags",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:ConfigureHealthCheck",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:CreateListener",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerListeners",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteListener",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancerListeners",
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"elasticloadbalancing:DeleteTargetGroup",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:DescribeInstanceHealth",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
"elasticloadbalancing:DescribeLoadBalancers",
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:DescribeTags",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer",
"elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
Fail with nice error message if elb target_type=ip not supported (#38313) * Add helpful failure message if target_type=ip is not supported Create test case for target_type=ip not supported * Update elb_target_group module to latest standards Use AnsibleAWSModule Improve exception handling Improve connection handling
2018-05-03 14:36:52 +02:00
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:RemoveTags"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
],
"Resource": "*"
},
{# Only certain lambda actions can be restricted to a specific resource #}
{# http://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html #}
{
"Sid": "AllowApiGateway",
"Effect": "Allow",
"Action": [
"apigateway:*"
],
"Resource": [
"arn:aws:apigateway:{{aws_region}}::/*"
]
},
{
"Sid": "AllowGetUserForLambdaCreation",
"Effect": "Allow",
"Action": [
"iam:GetUser"
],
"Resource": [
"arn:aws:iam::{{aws_account}}:user/ansible_integration_tests"
]
},
{
"Sid": "AllowLambdaManagementWithoutResource",
"Effect": "Allow",
"Action": [
"lambda:CreateEventSourceMapping",
"lambda:GetAccountSettings",
"lambda:GetEventSourceMapping",
"lambda:ListEventSourceMappings",
"lambda:ListFunctions",
"lambda:ListTags",
"lambda:TagResource",
"lambda:UntagResource"
],
"Resource": "*"
},
{
"Sid": "AllowLambdaManagementWithResource",
"Effect": "Allow",
"Action": [
"lambda:AddPermission",
"lambda:CreateAlias",
"lambda:CreateFunction",
"lambda:DeleteAlias",
"lambda:DeleteFunction",
"lambda:GetAlias",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:GetPolicy",
"lambda:InvokeFunction",
"lambda:ListAliases",
"lambda:ListVersionsByFunction",
"lambda:PublishVersion",
"lambda:RemovePermission",
"lambda:UpdateAlias",
"lambda:UpdateEventSourceMapping",
"lambda:UpdateFunctionCode",
"lambda:UpdateFunctionConfiguration"
],
"Resource": "arn:aws:lambda:{{aws_region}}:{{aws_account}}:function:*"
},
{
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"Sid": "AllowRoleManagement",
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
"arn:aws:iam::{{aws_account}}:role/ansible_lambda_role",
"arn:aws:iam::{{aws_account}}:role/ecsInstanceRole",
aws_eks_cluster: New module for managing AWS EKS (#41183) * aws_eks: New module for managing AWS EKS aws_eks module is used for creating and removing EKS clusters. Includes full test suite and updates to IAM policies to enable it. * Clean up all security groups * appease shippable * Rename aws_eks module to aws_eks_cluster
2018-06-07 14:44:04 +02:00
"arn:aws:iam::{{aws_account}}:role/ecsServiceRole",
ecs_taskdefinition can absent without containers argument (#41398) * ecs_taskdefinition can absent without containers argument * add regression test for absent with arn * Add PassRole privilege for ecs_cluster to pass
2018-07-12 15:16:41 +02:00
"arn:aws:iam::{{aws_account}}:role/aws_eks_cluster_role",
"arn:aws:iam::{{aws_account}}:role/ecsTaskExecutionRole"
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
]
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies
2017-12-15 14:15:01 +01:00
},
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
{
"Sid": "AllowSESManagement",
"Effect": "Allow",
"Action": [
"ses:VerifyEmailIdentity",
"ses:DeleteIdentity",
"ses:GetIdentityVerificationAttributes",
"ses:GetIdentityNotificationAttributes",
"ses:VerifyDomainIdentity",
"ses:SetIdentityNotificationTopic",
"ses:SetIdentityHeadersInNotificationsEnabled",
[cloud]Add aws_ses_identity_policy module for managing SES sending policies (#36623) * Add aws_ses_identity_policy module for managing SES sending policies * Add option to AnsibleAWSModule for applying a retry decorator to all calls. * Add per-callsite opt in to retry behaviours in AnsibleAWSModule * Update aws_ses_identity_policy module to opt in to retries at all callsites. * Add test for aws_ses_identity_policy module with inline policy. * Remove implicit retrys on boto resources since they're not working yet.
2018-04-05 21:11:12 +02:00
"ses:SetIdentityFeedbackForwardingEnabled",
"ses:GetIdentityPolicies",
"ses:PutIdentityPolicy",
"ses:DeleteIdentityPolicy",
"ses:ListIdentityPolicies"
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
],
"Resource": [
"*"
]
},
{
"Sid": "AllowSNSManagement",
"Effect": "Allow",
"Action": [
"SNS:CreateTopic",
"SNS:DeleteTopic",
"SNS:GetTopicAttributes",
sns_topic boto3 port (#39292) * Port sns_topic to boto3 and add tests
2018-08-24 03:04:18 +02:00
"SNS:ListSubscriptions",
"SNS:ListSubscriptionsByTopic",
"SNS:ListTopics",
"SNS:SetTopicAttributes",
"SNS:Subscribe",
"SNS:Unsubscribe"
New aws_ses_identity module to manage AWS Simple Email Service Identity (#31140) * Add aws_ses_identity module * Update CI alias, add BotoCoreError exception handling. * Add SES and SNS permissions to hacking/aws_config to run aws_ses_identity integration tests
2018-01-29 21:35:49 +01:00
],
"Resource": [
"*"
]
Consolidate IAM policies into fewer, larger policies (#33122) Due to IAM limits allowing at most 10 policies per group, need to reduce the number of total policies in use.
2017-11-21 23:15:31 +01:00
}
]
}
Reference in a new issue Copy permalink