Remove hacking/aws_config
AWS hacking config has been moved to the AWS CI terminator repo, and is no longer required in base. https://github.com/mattclay/aws-terminator/pull/91
This commit is contained in:
Jill Rouleau
Matt Clay
parent
9139c1f81d
commit
0bf7a08eb6
9 changed files with 0 additions and 1307 deletions
|
|
@ -1,330 +0,0 @@
|
||||||
# Requires pandas, bs4, html5lib, and lxml
|
|
||||||
#
|
|
||||||
# Call script with the output from aws_resource_actions callback, e.g.
|
|
||||||
# python build_iam_policy_framework.py ['ec2:AuthorizeSecurityGroupEgress', 'ec2:AuthorizeSecurityGroupIngress', 'sts:GetCallerIdentity']
|
|
||||||
#
|
|
||||||
# The sample output:
|
|
||||||
# {
|
|
||||||
# "Version": "2012-10-17",
|
|
||||||
# "Statement": [
|
|
||||||
# {
|
|
||||||
# "Sid": "AnsibleEditor0",
|
|
||||||
# "Effect": "Allow",
|
|
||||||
# "Action": [
|
|
||||||
# "ec2:AuthorizeSecurityGroupEgress",
|
|
||||||
# "ec2:AuthorizeSecurityGroupIngress"
|
|
||||||
# ],
|
|
||||||
# "Resource": "arn:aws:ec2:${Region}:${Account}:security-group/${SecurityGroupId}"
|
|
||||||
# },
|
|
||||||
# {
|
|
||||||
# "Sid": "AnsibleEditor1",
|
|
||||||
# "Effect": "Allow",
|
|
||||||
# "Action": [
|
|
||||||
# "sts:GetCallerIdentity"
|
|
||||||
# ],
|
|
||||||
# "Resource": "*"
|
|
||||||
# }
|
|
||||||
# ]
|
|
||||||
# }
|
|
||||||
#
|
|
||||||
# Policy troubleshooting:
|
|
||||||
# - If there are more actions in the policy than you provided, AWS has documented dependencies for some of your actions and
|
|
||||||
# those have been added to the policy.
|
|
||||||
# - If there are fewer actions in the policy than you provided, some of your actions are not in the IAM table of actions for
|
|
||||||
# that service. For example, the API call s3:DeleteObjects does not actually correlate to the permission needed in a policy.
|
|
||||||
# In this case s3:DeleteObject is the permission required to allow both the s3:DeleteObjects action and the s3:DeleteObject action.
|
|
||||||
# - The policies output are only as accurate as the AWS documentation. If the policy does not permit the
|
|
||||||
# necessary actions, look for undocumented dependencies. For example, redshift:CreateCluster requires ec2:DescribeVpcs,
|
|
||||||
# ec2:DescribeSubnets, ec2:DescribeSecurityGroups, and ec2:DescribeInternetGateways, but AWS does not document this.
|
|
||||||
#
|
|
||||||
|
|
||||||
from __future__ import (absolute_import, division, print_function)
|
|
||||||
__metaclass__ = type
|
|
||||||
|
|
||||||
import json
|
|
||||||
import requests
|
|
||||||
import sys
|
|
||||||
|
|
||||||
missing_dependencies = []
|
|
||||||
try:
|
|
||||||
import pandas as pd
|
|
||||||
except ImportError:
|
|
||||||
missing_dependencies.append('pandas')
|
|
||||||
try:
|
|
||||||
import bs4
|
|
||||||
except ImportError:
|
|
||||||
missing_dependencies.append('bs4')
|
|
||||||
try:
|
|
||||||
import html5lib
|
|
||||||
except ImportError:
|
|
||||||
missing_dependencies.append('html5lib')
|
|
||||||
try:
|
|
||||||
import lxml
|
|
||||||
except ImportError:
|
|
||||||
missing_dependencies.append('lxml')
|
|
||||||
|
|
||||||
|
|
||||||
irregular_service_names = {
|
|
||||||
'a4b': 'alexaforbusiness',
|
|
||||||
'appstream': 'appstream2.0',
|
|
||||||
'acm': 'certificatemanager',
|
|
||||||
'acm-pca': 'certificatemanagerprivatecertificateauthority',
|
|
||||||
'aws-marketplace-management': 'marketplacemanagementportal',
|
|
||||||
'ce': 'costexplorerservice',
|
|
||||||
'cognito-identity': 'cognitoidentity',
|
|
||||||
'cognito-sync': 'cognitosync',
|
|
||||||
'cognito-idp': 'cognitouserpools',
|
|
||||||
'cur': 'costandusagereport',
|
|
||||||
'dax': 'dynamodbacceleratordax',
|
|
||||||
'dlm': 'datalifecyclemanager',
|
|
||||||
'dms': 'databasemigrationservice',
|
|
||||||
'ds': 'directoryservice',
|
|
||||||
'ec2messages': 'messagedeliveryservice',
|
|
||||||
'ecr': 'ec2containerregistry',
|
|
||||||
'ecs': 'elasticcontainerservice',
|
|
||||||
'eks': 'elasticcontainerserviceforkubernetes',
|
|
||||||
'efs': 'elasticfilesystem',
|
|
||||||
'es': 'elasticsearchservice',
|
|
||||||
'events': 'cloudwatchevents',
|
|
||||||
'firehose': 'kinesisfirehose',
|
|
||||||
'fms': 'firewallmanager',
|
|
||||||
'health': 'healthapisandnotifications',
|
|
||||||
'importexport': 'importexportdiskservice',
|
|
||||||
'iot1click': 'iot1-click',
|
|
||||||
'kafka': 'managedstreamingforkafka',
|
|
||||||
'kinesisvideo': 'kinesisvideostreams',
|
|
||||||
'kms': 'keymanagementservice',
|
|
||||||
'license-manager': 'licensemanager',
|
|
||||||
'logs': 'cloudwatchlogs',
|
|
||||||
'opsworks-cm': 'opsworksconfigurationmanagement',
|
|
||||||
'mediaconnect': 'elementalmediaconnect',
|
|
||||||
'mediaconvert': 'elementalmediaconvert',
|
|
||||||
'medialive': 'elementalmedialive',
|
|
||||||
'mediapackage': 'elementalmediapackage',
|
|
||||||
'mediastore': 'elementalmediastore',
|
|
||||||
'mgh': 'migrationhub',
|
|
||||||
'mobiletargeting': 'pinpoint',
|
|
||||||
'pi': 'performanceinsights',
|
|
||||||
'pricing': 'pricelist',
|
|
||||||
'ram': 'resourceaccessmanager',
|
|
||||||
'resource-groups': 'resourcegroups',
|
|
||||||
'sdb': 'simpledb',
|
|
||||||
'servicediscovery': 'cloudmap',
|
|
||||||
'serverlessrepo': 'serverlessapplicationrepository',
|
|
||||||
'sms': 'servermigrationservice',
|
|
||||||
'sms-voice': 'pinpointsmsandvoiceservice',
|
|
||||||
'sso-directory': 'ssodirectory',
|
|
||||||
'ssm': 'systemsmanager',
|
|
||||||
'ssmmessages': 'sessionmanagermessagegatewayservice',
|
|
||||||
'states': 'stepfunctions',
|
|
||||||
'sts': 'securitytokenservice',
|
|
||||||
'swf': 'simpleworkflowservice',
|
|
||||||
'tag': 'resourcegrouptaggingapi',
|
|
||||||
'transfer': 'transferforsftp',
|
|
||||||
'waf-regional': 'wafregional',
|
|
||||||
'wam': 'workspacesapplicationmanager',
|
|
||||||
'xray': 'x-ray'
|
|
||||||
}
|
|
||||||
|
|
||||||
irregular_service_links = {
|
|
||||||
'apigateway': [
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_manageamazonapigateway.html'
|
|
||||||
],
|
|
||||||
'aws-marketplace': [
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsmarketplace.html',
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsmarketplacemeteringservice.html',
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awsprivatemarketplace.html'
|
|
||||||
],
|
|
||||||
'discovery': [
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_applicationdiscovery.html'
|
|
||||||
],
|
|
||||||
'elasticloadbalancing': [
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_elasticloadbalancing.html',
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_elasticloadbalancingv2.html'
|
|
||||||
],
|
|
||||||
'globalaccelerator': [
|
|
||||||
'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_globalaccelerator.html'
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
def get_docs_by_prefix(prefix):
|
|
||||||
amazon_link_form = 'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazon{0}.html'
|
|
||||||
aws_link_form = 'https://docs.aws.amazon.com/IAM/latest/UserGuide/list_aws{0}.html'
|
|
||||||
|
|
||||||
if prefix in irregular_service_links:
|
|
||||||
links = irregular_service_links[prefix]
|
|
||||||
else:
|
|
||||||
if prefix in irregular_service_names:
|
|
||||||
prefix = irregular_service_names[prefix]
|
|
||||||
links = [amazon_link_form.format(prefix), aws_link_form.format(prefix)]
|
|
||||||
|
|
||||||
return links
|
|
||||||
|
|
||||||
|
|
||||||
def get_html(links):
|
|
||||||
html_list = []
|
|
||||||
for link in links:
|
|
||||||
html = requests.get(link).content
|
|
||||||
try:
|
|
||||||
parsed_html = pd.read_html(html)
|
|
||||||
html_list.append(parsed_html)
|
|
||||||
except ValueError as e:
|
|
||||||
if 'No tables found' in str(e):
|
|
||||||
pass
|
|
||||||
else:
|
|
||||||
raise e
|
|
||||||
|
|
||||||
return html_list
|
|
||||||
|
|
||||||
|
|
||||||
def get_tables(service):
|
|
||||||
links = get_docs_by_prefix(service)
|
|
||||||
html_list = get_html(links)
|
|
||||||
action_tables = []
|
|
||||||
arn_tables = []
|
|
||||||
for df_list in html_list:
|
|
||||||
for df in df_list:
|
|
||||||
table = json.loads(df.to_json(orient='split'))
|
|
||||||
table_data = table['data'][0]
|
|
||||||
if 'Actions' in table_data and 'Resource Types (*required)' in table_data:
|
|
||||||
action_tables.append(table['data'][1::])
|
|
||||||
elif 'Resource Types' in table_data and 'ARN' in table_data:
|
|
||||||
arn_tables.append(table['data'][1::])
|
|
||||||
|
|
||||||
# Action table indices:
|
|
||||||
# 0: Action, 1: Description, 2: Access level, 3: Resource type, 4: Condition keys, 5: Dependent actions
|
|
||||||
# ARN tables indices:
|
|
||||||
# 0: Resource type, 1: ARN template, 2: Condition keys
|
|
||||||
return action_tables, arn_tables
|
|
||||||
|
|
||||||
|
|
||||||
def add_dependent_action(resources, dependency):
|
|
||||||
resource, action = dependency.split(':')
|
|
||||||
if resource in resources:
|
|
||||||
resources[resource].append(action)
|
|
||||||
else:
|
|
||||||
resources[resource] = [action]
|
|
||||||
return resources
|
|
||||||
|
|
||||||
|
|
||||||
def get_dependent_actions(resources):
|
|
||||||
for service in dict(resources):
|
|
||||||
action_tables, arn_tables = get_tables(service)
|
|
||||||
for found_action_table in action_tables:
|
|
||||||
for action_stuff in found_action_table:
|
|
||||||
if action_stuff is None:
|
|
||||||
continue
|
|
||||||
if action_stuff[0] in resources[service] and action_stuff[5]:
|
|
||||||
dependencies = action_stuff[5].split()
|
|
||||||
if isinstance(dependencies, list):
|
|
||||||
for dependency in dependencies:
|
|
||||||
resources = add_dependent_action(resources, dependency)
|
|
||||||
else:
|
|
||||||
resources = add_dependent_action(resources, dependencies)
|
|
||||||
return resources
|
|
||||||
|
|
||||||
|
|
||||||
def get_actions_by_service(resources):
|
|
||||||
service_action_dict = {}
|
|
||||||
dependencies = {}
|
|
||||||
for service in resources:
|
|
||||||
action_tables, arn_tables = get_tables(service)
|
|
||||||
|
|
||||||
# Create dict of the resource type to the corresponding ARN
|
|
||||||
arn_dict = {}
|
|
||||||
for found_arn_table in arn_tables:
|
|
||||||
for arn_stuff in found_arn_table:
|
|
||||||
arn_dict["{0}*".format(arn_stuff[0])] = arn_stuff[1]
|
|
||||||
|
|
||||||
# Create dict of the action to the corresponding ARN
|
|
||||||
action_dict = {}
|
|
||||||
for found_action_table in action_tables:
|
|
||||||
for action_stuff in found_action_table:
|
|
||||||
if action_stuff[0] is None:
|
|
||||||
continue
|
|
||||||
if arn_dict.get(action_stuff[3]):
|
|
||||||
action_dict[action_stuff[0]] = arn_dict[action_stuff[3]]
|
|
||||||
else:
|
|
||||||
action_dict[action_stuff[0]] = None
|
|
||||||
service_action_dict[service] = action_dict
|
|
||||||
return service_action_dict
|
|
||||||
|
|
||||||
|
|
||||||
def get_resource_arns(aws_actions, action_dict):
|
|
||||||
resource_arns = {}
|
|
||||||
for resource_action in aws_actions:
|
|
||||||
resource, action = resource_action.split(':')
|
|
||||||
if action not in action_dict:
|
|
||||||
continue
|
|
||||||
if action_dict[action] is None:
|
|
||||||
resource = "*"
|
|
||||||
else:
|
|
||||||
resource = action_dict[action].replace("${Partition}", "aws")
|
|
||||||
if resource not in resource_arns:
|
|
||||||
resource_arns[resource] = []
|
|
||||||
resource_arns[resource].append(resource_action)
|
|
||||||
return resource_arns
|
|
||||||
|
|
||||||
|
|
||||||
def get_resources(actions):
|
|
||||||
resources = {}
|
|
||||||
for action in actions:
|
|
||||||
resource, action = action.split(':')
|
|
||||||
if resource not in resources:
|
|
||||||
resources[resource] = []
|
|
||||||
resources[resource].append(action)
|
|
||||||
return resources
|
|
||||||
|
|
||||||
|
|
||||||
def combine_arn_actions(resources, service_action_arn_dict):
|
|
||||||
arn_actions = {}
|
|
||||||
for service in service_action_arn_dict:
|
|
||||||
service_arn_actions = get_resource_arns(aws_actions, service_action_arn_dict[service])
|
|
||||||
for resource in service_arn_actions:
|
|
||||||
if resource in arn_actions:
|
|
||||||
arn_actions[resource].extend(service_arn_actions[resource])
|
|
||||||
else:
|
|
||||||
arn_actions[resource] = service_arn_actions[resource]
|
|
||||||
return arn_actions
|
|
||||||
|
|
||||||
|
|
||||||
def combine_actions_and_dependent_actions(resources):
|
|
||||||
aws_actions = []
|
|
||||||
for resource in resources:
|
|
||||||
for action in resources[resource]:
|
|
||||||
aws_actions.append('{0}:{1}'.format(resource, action))
|
|
||||||
return set(aws_actions)
|
|
||||||
|
|
||||||
|
|
||||||
def get_actions_restricted_by_arn(aws_actions):
|
|
||||||
resources = get_resources(aws_actions)
|
|
||||||
resources = get_dependent_actions(resources)
|
|
||||||
service_action_arn_dict = get_actions_by_service(resources)
|
|
||||||
aws_actions = combine_actions_and_dependent_actions(resources)
|
|
||||||
return combine_arn_actions(aws_actions, service_action_arn_dict)
|
|
||||||
|
|
||||||
|
|
||||||
def main(aws_actions):
|
|
||||||
arn_actions = get_actions_restricted_by_arn(aws_actions)
|
|
||||||
statement = []
|
|
||||||
for resource_restriction in arn_actions:
|
|
||||||
statement.append({
|
|
||||||
"Sid": "AnsibleEditor{0}".format(len(statement)),
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": arn_actions[resource_restriction],
|
|
||||||
"Resource": resource_restriction
|
|
||||||
})
|
|
||||||
|
|
||||||
policy = {"Version": "2012-10-17", "Statement": statement}
|
|
||||||
print(json.dumps(policy, indent=4))
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
if missing_dependencies:
|
|
||||||
sys.exit('Missing Python libraries: {0}'.format(', '.join(missing_dependencies)))
|
|
||||||
actions = sys.argv[1:]
|
|
||||||
if len(actions) == 1:
|
|
||||||
actions = sys.argv[1].split(',')
|
|
||||||
aws_actions = [action.strip('[], "\'') for action in actions]
|
|
||||||
main(aws_actions)
|
|
||||||
|
|
@ -1,55 +0,0 @@
|
||||||
# Usage: ansible-playbook setup-iam.yml -e iam_group=ansible_test -vv
|
|
||||||
#
|
|
||||||
# Creates IAM policies and associates them with iam_group. This group
|
|
||||||
# can then be associated with an appropriate user
|
|
||||||
#
|
|
||||||
# You can pass -e profile=boto_profile_name if you have a profile that
|
|
||||||
# you can use, otherwise use normal AWS methods (env variables, instance
|
|
||||||
# profile, etc)
|
|
||||||
#
|
|
||||||
# If you want to use a region other than us-east-1 (and only us-east-2
|
|
||||||
# works with ansible-test), pass -e region=us-east-2
|
|
||||||
#
|
|
||||||
# Requires 2.4 for iam_managed_policy and iam_group
|
|
||||||
|
|
||||||
- hosts: localhost
|
|
||||||
connection: local
|
|
||||||
gather_facts: no
|
|
||||||
vars:
|
|
||||||
aws_region: "{{ region|default('us-east-1') }}"
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Check that required variables are set
|
|
||||||
fail:
|
|
||||||
msg: "You must set the iam_group variable"
|
|
||||||
when: iam_group is not defined
|
|
||||||
|
|
||||||
- name: Get aws account ID
|
|
||||||
aws_caller_info:
|
|
||||||
profile: "{{ profile|default(omit) }}"
|
|
||||||
register: aws_caller_info
|
|
||||||
|
|
||||||
- name: Set aws_account_fact
|
|
||||||
set_fact:
|
|
||||||
aws_account: "{{ aws_caller_info.account }}"
|
|
||||||
|
|
||||||
|
|
||||||
- name: Ensure Managed IAM policies exist
|
|
||||||
iam_managed_policy:
|
|
||||||
policy_name: "AnsibleTest{{ item|basename|regex_replace('-.*', '')|capitalize }}Policy"
|
|
||||||
policy: "{{ lookup('template', item) }}"
|
|
||||||
state: present
|
|
||||||
profile: "{{ profile|default(omit) }}"
|
|
||||||
with_fileglob: "testing_policies/*.json"
|
|
||||||
register: iam_managed_policies
|
|
||||||
|
|
||||||
- debug:
|
|
||||||
msg: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
|
|
||||||
|
|
||||||
- name: Ensure IAM group exists and attach managed policies
|
|
||||||
iam_group:
|
|
||||||
name: "{{ iam_group }}"
|
|
||||||
state: present
|
|
||||||
managed_policy: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
|
|
||||||
profile: "{{ profile|default(omit) }}"
|
|
||||||
purge_policy: yes
|
|
||||||
|
|
@ -1,280 +0,0 @@
|
||||||
{# Not all Autoscaling API Actions allow specified resources #}
|
|
||||||
{# See http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources #}
|
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Sid": "DescribeAutoscaling",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"autoscaling:DescribeAutoScalingGroups",
|
|
||||||
"autoscaling:DescribeLaunchConfigurations",
|
|
||||||
"autoscaling:DescribePolicies"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAutoscaling",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"autoscaling:*LaunchConfiguration",
|
|
||||||
"autoscaling:*LoadBalancers",
|
|
||||||
"autoscaling:*AutoScalingGroup",
|
|
||||||
"autoscaling:*MetricsCollection",
|
|
||||||
"autoscaling:PutScalingPolicy",
|
|
||||||
"autoscaling:DeletePolicy",
|
|
||||||
"autoscaling:*Tags"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:autoscaling:{{aws_region}}:{{aws_account}}:*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{# Note that not all EC2 API Actions allow a specific resource #}
|
|
||||||
{# See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions #}
|
|
||||||
{
|
|
||||||
"Sid": "AllowUnspecifiedEC2Resource",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ec2:*LaunchTemplate",
|
|
||||||
"ec2:*LaunchTemplateVersion",
|
|
||||||
"ec2:*LaunchTemplateVersions",
|
|
||||||
"ec2:AttachVolume",
|
|
||||||
"ec2:CreateImage",
|
|
||||||
"ec2:CreateKeyPair",
|
|
||||||
"ec2:CreateSecurityGroup",
|
|
||||||
"ec2:CreateSnapshot",
|
|
||||||
"ec2:CreateTags",
|
|
||||||
"ec2:DeleteKeyPair",
|
|
||||||
"ec2:DeleteSnapshot",
|
|
||||||
"ec2:DeleteTags",
|
|
||||||
"ec2:DeregisterImage",
|
|
||||||
"ec2:Describe*",
|
|
||||||
"ec2:DetachVolume",
|
|
||||||
"ec2:ImportKeyPair",
|
|
||||||
"ec2:ModifyImageAttribute",
|
|
||||||
"ec2:ModifyInstanceAttribute",
|
|
||||||
"ec2:RegisterImage",
|
|
||||||
"ec2:ReplaceIamInstanceProfileAssociation",
|
|
||||||
"ec2:ReportInstanceStatus"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowSpecifiedEC2Resource",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ec2:AuthorizeSecurityGroupIngress",
|
|
||||||
"ec2:AuthorizeSecurityGroupEgress",
|
|
||||||
"ec2:CreateTags",
|
|
||||||
"ec2:CreateVolume",
|
|
||||||
"ec2:DeleteRouteTable",
|
|
||||||
"ec2:DeleteSecurityGroup",
|
|
||||||
"ec2:DeleteVolume",
|
|
||||||
"ec2:RevokeSecurityGroupEgress",
|
|
||||||
"ec2:RevokeSecurityGroupIngress",
|
|
||||||
"ec2:RunInstances",
|
|
||||||
"ec2:StartInstances",
|
|
||||||
"ec2:StopInstances",
|
|
||||||
"ec2:TerminateInstances",
|
|
||||||
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
|
|
||||||
"ec2:UpdateSecurityGroupRuleDescriptionsEgress"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:ec2:{{aws_region}}::image/*",
|
|
||||||
"arn:aws:ec2:{{aws_region}}:{{aws_account}}:*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{# According to http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html #}
|
|
||||||
{# Resource level access control is not possible for the new ELB API (providing Application Load Balancer functionality #}
|
|
||||||
{# While it remains possible for the old API, there is no distinction of the Actions between old API and new API #}
|
|
||||||
{
|
|
||||||
"Sid": "AllowLoadBalancerOperations",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"elasticloadbalancing:*LoadBalancer",
|
|
||||||
"elasticloadbalancing:*LoadBalancers",
|
|
||||||
"elasticloadbalancing:*LoadBalancerListeners",
|
|
||||||
"elasticloadbalancing:*TargetGroup",
|
|
||||||
"elasticloadbalancing:AddTags",
|
|
||||||
"elasticloadbalancing:ConfigureHealthCheck",
|
|
||||||
"elasticloadbalancing:Create*",
|
|
||||||
"elasticloadbalancing:Delete*",
|
|
||||||
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
|
|
||||||
"elasticloadbalancing:Describe*",
|
|
||||||
"elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer",
|
|
||||||
"elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer",
|
|
||||||
"elasticloadbalancing:Modify*",
|
|
||||||
"elasticloadbalancing:Register*",
|
|
||||||
"elasticloadbalancing:Deregister*",
|
|
||||||
"elasticloadbalancing:Remove*"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{# Only certain lambda actions can be restricted to a specific resource #}
|
|
||||||
{# http://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html #}
|
|
||||||
{
|
|
||||||
"Sid": "AllowApiGateway",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"apigateway:*"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:apigateway:{{aws_region}}::/*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowGetUserForLambdaCreation",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"iam:GetUser"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:iam::{{aws_account}}:user/ansible_integration_tests"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowLambdaManagementWithoutResource",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"lambda:CreateEventSourceMapping",
|
|
||||||
"lambda:GetAccountSettings",
|
|
||||||
"lambda:GetEventSourceMapping",
|
|
||||||
"lambda:List*",
|
|
||||||
"lambda:TagResource",
|
|
||||||
"lambda:UntagResource"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowLambdaManagementWithResource",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"lambda:AddPermission",
|
|
||||||
"lambda:CreateAlias",
|
|
||||||
"lambda:CreateFunction",
|
|
||||||
"lambda:DeleteAlias",
|
|
||||||
"lambda:DeleteFunction",
|
|
||||||
"lambda:GetAlias",
|
|
||||||
"lambda:GetFunction",
|
|
||||||
"lambda:GetFunctionConfiguration",
|
|
||||||
"lambda:GetPolicy",
|
|
||||||
"lambda:InvokeFunction",
|
|
||||||
"lambda:PublishVersion",
|
|
||||||
"lambda:RemovePermission",
|
|
||||||
"lambda:UpdateAlias",
|
|
||||||
"lambda:UpdateEventSourceMapping",
|
|
||||||
"lambda:UpdateFunctionCode",
|
|
||||||
"lambda:UpdateFunctionConfiguration"
|
|
||||||
],
|
|
||||||
"Resource": "arn:aws:lambda:{{aws_region}}:{{aws_account}}:function:*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowRoleManagement",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"iam:PassRole"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:iam::{{aws_account}}:role/ansible_lambda_role",
|
|
||||||
"arn:aws:iam::{{aws_account}}:role/ecsInstanceRole",
|
|
||||||
"arn:aws:iam::{{aws_account}}:role/ec2InstanceRole",
|
|
||||||
"arn:aws:iam::{{aws_account}}:role/ecsServiceRole",
|
|
||||||
"arn:aws:iam::{{aws_account}}:role/aws_eks_cluster_role",
|
|
||||||
"arn:aws:iam::{{aws_account}}:role/ecsTaskExecutionRole"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowSESManagement",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ses:VerifyEmailIdentity",
|
|
||||||
"ses:DeleteIdentity",
|
|
||||||
"ses:GetIdentityVerificationAttributes",
|
|
||||||
"ses:GetIdentityNotificationAttributes",
|
|
||||||
"ses:VerifyDomainIdentity",
|
|
||||||
"ses:SetIdentityNotificationTopic",
|
|
||||||
"ses:SetIdentityHeadersInNotificationsEnabled",
|
|
||||||
"ses:SetIdentityFeedbackForwardingEnabled",
|
|
||||||
"ses:GetIdentityPolicies",
|
|
||||||
"ses:PutIdentityPolicy",
|
|
||||||
"ses:DeleteIdentityPolicy",
|
|
||||||
"ses:ListIdentityPolicies",
|
|
||||||
"ses:SetIdentityFeedbackForwardingEnabled",
|
|
||||||
"ses:ListReceiptRuleSets",
|
|
||||||
"ses:DescribeReceiptRuleSet",
|
|
||||||
"ses:DescribeActiveReceiptRuleSet",
|
|
||||||
"ses:SetActiveReceiptRuleSet",
|
|
||||||
"ses:CreateReceiptRuleSet",
|
|
||||||
"ses:DeleteReceiptRuleSet"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowSNSManagement",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"SNS:CreateTopic",
|
|
||||||
"SNS:DeleteTopic",
|
|
||||||
"SNS:GetTopicAttributes",
|
|
||||||
"SNS:ListSubscriptions",
|
|
||||||
"SNS:ListSubscriptionsByTopic",
|
|
||||||
"SNS:ListTopics",
|
|
||||||
"SNS:SetTopicAttributes",
|
|
||||||
"SNS:Subscribe",
|
|
||||||
"SNS:Unsubscribe"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowStepFunctionsStateMachine",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"states:CreateStateMachine",
|
|
||||||
"states:DeleteStateMachine",
|
|
||||||
"states:DescribeExecution",
|
|
||||||
"states:DescribeStateMachine",
|
|
||||||
"states:ListExecutions",
|
|
||||||
"states:ListStateMachines",
|
|
||||||
"states:ListTagsForResource",
|
|
||||||
"states:StartExecution",
|
|
||||||
"states:StopExecution",
|
|
||||||
"states:TagResource",
|
|
||||||
"states:UntagResource",
|
|
||||||
"states:UpdateStateMachine"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:states:*:*:*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowLightsail",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"lightsail:CreateInstances",
|
|
||||||
"lightsail:DeleteInstance",
|
|
||||||
"lightsail:GetInstance",
|
|
||||||
"lightsail:GetInstances",
|
|
||||||
"lightsail:RebootInstance",
|
|
||||||
"lightsail:StartInstance",
|
|
||||||
"lightsail:StopInstance"
|
|
||||||
],
|
|
||||||
"Resource": "arn:aws:lightsail:*:*:*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowSQS",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"sqs:GetQueueURL",
|
|
||||||
"sqs:CreateQueue",
|
|
||||||
"sqs:GetQueueAttributes",
|
|
||||||
"sqs:DeleteQueue",
|
|
||||||
"sqs:SetQueueAttributes"
|
|
||||||
],
|
|
||||||
"Resource": "arn:aws:sqs:*:*:*"
|
|
||||||
},
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,80 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Sid": "UnspecifiedCodeRepositories",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ecr:DescribeRepositories",
|
|
||||||
"ecr:CreateRepository"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "SpecifiedCodeRepositories",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ecr:GetLifecyclePolicy",
|
|
||||||
"ecr:PutLifecyclePolicy",
|
|
||||||
"ecr:DeleteLifecyclePolicy",
|
|
||||||
"ecr:GetRepositoryPolicy",
|
|
||||||
"ecr:SetRepositoryPolicy",
|
|
||||||
"ecr:DeleteRepository",
|
|
||||||
"ecr:DeleteRepositoryPolicy",
|
|
||||||
"ecr:DeleteRepositoryPolicy"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:ecr:{{aws_region}}:{{aws_account}}:repository/ansible-*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"application-autoscaling:Describe*",
|
|
||||||
"application-autoscaling:PutScalingPolicy",
|
|
||||||
"application-autoscaling:RegisterScalableTarget",
|
|
||||||
"cloudwatch:DescribeAlarms",
|
|
||||||
"cloudwatch:PutMetricAlarm",
|
|
||||||
"ecs:CreateCluster",
|
|
||||||
"ecs:CreateService",
|
|
||||||
"ecs:DeleteCluster",
|
|
||||||
"ecs:DeleteService",
|
|
||||||
"ecs:DeregisterTaskDefinition",
|
|
||||||
"ecs:Describe*",
|
|
||||||
"ecs:List*",
|
|
||||||
"ecs:PutAccountSetting",
|
|
||||||
"ecs:RegisterTaskDefinition",
|
|
||||||
"ecs:RunTask",
|
|
||||||
"ecs:StartTask",
|
|
||||||
"ecs:StopTask",
|
|
||||||
"ecs:UpdateService",
|
|
||||||
"elasticloadbalancing:Describe*",
|
|
||||||
"iam:GetInstanceProfile",
|
|
||||||
"iam:GetPolicy",
|
|
||||||
"iam:GetPolicyVersion",
|
|
||||||
"iam:GetRole",
|
|
||||||
"iam:ListAttachedRolePolicies",
|
|
||||||
"iam:ListGroups",
|
|
||||||
"iam:ListRoles",
|
|
||||||
"iam:ListUsers"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"eks:CreateCluster",
|
|
||||||
"eks:DeleteCluster",
|
|
||||||
"eks:DescribeCluster",
|
|
||||||
"eks:ListClusters"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,123 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Action": "iam:CreateServiceLinkedRole",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
|
|
||||||
"Condition": {
|
|
||||||
"StringLike": {
|
|
||||||
"iam:AWSServiceName":"rds.amazonaws.com"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Action": "iam:CreateServiceLinkedRole",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Resource": "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift",
|
|
||||||
"Condition": {
|
|
||||||
"StringLike": {
|
|
||||||
"iam:AWSServiceName": "redshift.amazonaws.com"}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowRDSReadEverywhere",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"rds:ListTagsForResource",
|
|
||||||
"rds:DescribeDBInstances",
|
|
||||||
"rds:DescribeDBParameterGroups",
|
|
||||||
"rds:DescribeDBParameters",
|
|
||||||
"rds:DescribeDBSnapshots"
|
|
||||||
],
|
|
||||||
"Resource": ["*"]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowRDSModuleTests",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"rds:AddTagsToResource",
|
|
||||||
"rds:CreateDBInstance",
|
|
||||||
"rds:DeleteDBInstance",
|
|
||||||
"rds:ModifyDBInstance",
|
|
||||||
"rds:PromoteReadReplica",
|
|
||||||
"rds:RebootDBInstance",
|
|
||||||
"rds:RemoveTagsFromResource",
|
|
||||||
"rds:RestoreDBInstanceToPointInTime",
|
|
||||||
"rds:StartDBInstance",
|
|
||||||
"rds:StopDBInstance"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:db:ansible-test*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowRDSSnapshotManageSnapshots",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"rds:AddTagsToResource",
|
|
||||||
"rds:CreateDBSnapshot",
|
|
||||||
"rds:DeleteDBInstance",
|
|
||||||
"rds:DeleteDBSnapshot",
|
|
||||||
"rds:RemoveTagsFromResource",
|
|
||||||
"rds:RestoreDBInstanceFromDBSnapshot",
|
|
||||||
"rds:CreateDBInstanceReadReplica"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:snapshot:ansible-test*",
|
|
||||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:db:ansible-test*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowRDSParameterGroupManagement",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"rds:CreateDBParameterGroup",
|
|
||||||
"rds:DeleteDBParameterGroup",
|
|
||||||
"rds:ModifyDBParameterGroup",
|
|
||||||
"rds:AddTagsToResource",
|
|
||||||
"rds:RemoveTagsFromResource"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:pg:*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowRedshiftManagment",
|
|
||||||
"Action": [
|
|
||||||
"redshift:CreateCluster",
|
|
||||||
"redshift:CreateTags",
|
|
||||||
"redshift:DeleteCluster",
|
|
||||||
"redshift:DeleteTags",
|
|
||||||
"redshift:DescribeClusters",
|
|
||||||
"redshift:DescribeTags",
|
|
||||||
"redshift:ModifyCluster",
|
|
||||||
"redshift:RebootCluster"
|
|
||||||
],
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowRDSSubnetGroups",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"rds:CreateDBSubnetGroup",
|
|
||||||
"rds:DeleteDBSubnetGroup",
|
|
||||||
"rds:DescribeDBSubnetGroups",
|
|
||||||
"rds:ModifyDBSubnetGroup"
|
|
||||||
],
|
|
||||||
"Resource": ["*"]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "DMSEndpoints",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"dms:CreateEndpoint",
|
|
||||||
"dms:DeleteEndpoint",
|
|
||||||
"dms:DescribeEndpoints",
|
|
||||||
"dms:ModifyEndpoint"
|
|
||||||
],
|
|
||||||
"Resource": ["*"]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,40 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Sid": "AllowCodeCommitModuleTests",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"codecommit:ListRepositories",
|
|
||||||
"codecommit:*Repository",
|
|
||||||
"codecommit:*RepositoryDescription"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowCloudformationTests",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"cloudformation:CreateChangeSet",
|
|
||||||
"cloudformation:CreateStack",
|
|
||||||
"cloudformation:DeleteChangeSet",
|
|
||||||
"cloudformation:DeleteStack",
|
|
||||||
"cloudformation:DescribeChangeSet",
|
|
||||||
"cloudformation:DescribeStackEvents",
|
|
||||||
"cloudformation:DescribeStacks",
|
|
||||||
"cloudformation:GetStackPolicy",
|
|
||||||
"cloudformation:GetTemplate",
|
|
||||||
"cloudformation:ListChangeSets",
|
|
||||||
"cloudformation:ListExports",
|
|
||||||
"cloudformation:ListStackResources",
|
|
||||||
"cloudformation:UpdateStack",
|
|
||||||
"cloudformation:UpdateTerminationProtection"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,117 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Sid": "ManageRoute53ForTests",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"route53:CreateHostedZone",
|
|
||||||
"route53:ChangeResourceRecordSets",
|
|
||||||
"route53:DeleteHostedZone",
|
|
||||||
"route53:GetHostedZone",
|
|
||||||
"route53:ListHostedZones",
|
|
||||||
"route53:ListResourceRecordSets",
|
|
||||||
"route53:UpdateHostedZoneComment"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowInternetGatewayManagement",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ec2:CreateInternetGateway",
|
|
||||||
"ec2:DeleteInternetGateway",
|
|
||||||
"ec2:DescribeInternetGateways"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowTransitGatewayManagement",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ec2:CreateTransitGateway",
|
|
||||||
"ec2:DeleteTransitGateway",
|
|
||||||
"ec2:DescribeTransitGateways"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowUnspecifiedEC2NetworkingResource",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"ec2:AllocateAddress",
|
|
||||||
"ec2:AssociateAddress",
|
|
||||||
"ec2:AssociateDhcpOptions",
|
|
||||||
"ec2:AssociateRouteTable",
|
|
||||||
"ec2:AssociateVpcCidrBlock",
|
|
||||||
"ec2:AssociateSubnetCidrBlock",
|
|
||||||
"ec2:AttachInternetGateway",
|
|
||||||
"ec2:AttachNetworkInterface",
|
|
||||||
"ec2:AttachVpnGateway",
|
|
||||||
"ec2:CreateCustomerGateway",
|
|
||||||
"ec2:CreateDhcpOptions",
|
|
||||||
"ec2:CreateNatGateway",
|
|
||||||
"ec2:CreateNetworkAcl",
|
|
||||||
"ec2:CreateNetworkAclEntry",
|
|
||||||
"ec2:CreateNetworkInterface",
|
|
||||||
"ec2:CreateRoute",
|
|
||||||
"ec2:CreateRouteTable",
|
|
||||||
"ec2:CreateSubnet",
|
|
||||||
"ec2:CreateVpc",
|
|
||||||
"ec2:CreateVpnConnection",
|
|
||||||
"ec2:CreateVpnGateway",
|
|
||||||
"ec2:DeleteCustomerGateway",
|
|
||||||
"ec2:DeleteDhcpOptions",
|
|
||||||
"ec2:DeleteInternetGateway",
|
|
||||||
"ec2:DeleteNatGateway",
|
|
||||||
"ec2:DeleteNetworkAcl",
|
|
||||||
"ec2:DeleteNetworkAclEntry",
|
|
||||||
"ec2:DeleteNetworkInterface",
|
|
||||||
"ec2:DeleteRoute",
|
|
||||||
"ec2:DeleteRouteTable",
|
|
||||||
"ec2:DeleteSubnet",
|
|
||||||
"ec2:DeleteVpc",
|
|
||||||
"ec2:DeleteVpnConnection",
|
|
||||||
"ec2:DeleteVpnGateway",
|
|
||||||
"ec2:DetachInternetGateway",
|
|
||||||
"ec2:DetachVpnGateway",
|
|
||||||
"ec2:Describe*",
|
|
||||||
"ec2:DisassociateAddress",
|
|
||||||
"ec2:DisassociateRouteTable",
|
|
||||||
"ec2:DisassociateSubnetCidrBlock",
|
|
||||||
"ec2:DisassociateVpcCidrBlock",
|
|
||||||
"ec2:ModifySubnetAttribute",
|
|
||||||
"ec2:ModifyVpcAttribute",
|
|
||||||
"ec2:ReleaseAddress",
|
|
||||||
"ec2:ReplaceNetworkAclAssociation",
|
|
||||||
"ec2:ReplaceNetworkAclEntry",
|
|
||||||
"ec2:ReplaceRouteTableAssociation"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowCloudfrontUsage",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"cloudfront:CreateDistribution",
|
|
||||||
"cloudfront:CreateDistributionWithTags",
|
|
||||||
"cloudfront:CreateCloudFrontOriginAccessIdentity",
|
|
||||||
"cloudfront:DeleteDistribution",
|
|
||||||
"cloudfront:GetDistribution",
|
|
||||||
"cloudfront:GetStreamingDistribution",
|
|
||||||
"cloudfront:GetDistributionConfig",
|
|
||||||
"cloudfront:GetStreamingDistributionConfig",
|
|
||||||
"cloudfront:GetInvalidation",
|
|
||||||
"cloudfront:ListDistributions",
|
|
||||||
"cloudfront:ListDistributionsByWebACLId",
|
|
||||||
"cloudfront:ListInvalidations",
|
|
||||||
"cloudfront:ListStreamingDistributions",
|
|
||||||
"cloudfront:ListTagsForResource",
|
|
||||||
"cloudfront:TagResource",
|
|
||||||
"cloudfront:UntagResource",
|
|
||||||
"cloudfront:UpdateDistribution"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,228 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Action": [
|
|
||||||
"iam:GetGroup",
|
|
||||||
"iam:GetInstanceProfile",
|
|
||||||
"iam:CreateInstanceProfile",
|
|
||||||
"iam:GetPolicy",
|
|
||||||
"iam:GetPolicyVersion",
|
|
||||||
"iam:GetRole",
|
|
||||||
"iam:GetRolePolicy",
|
|
||||||
"iam:GetUser",
|
|
||||||
"iam:ListAttachedGroupPolicies",
|
|
||||||
"iam:ListAttachedRolePolicies",
|
|
||||||
"iam:ListAttachedUserPolicies",
|
|
||||||
"iam:ListGroups",
|
|
||||||
"iam:ListInstanceProfiles",
|
|
||||||
"iam:ListInstanceProfilesForRole",
|
|
||||||
"iam:ListPolicies",
|
|
||||||
"iam:ListRoles",
|
|
||||||
"iam:ListRolePolicies",
|
|
||||||
"iam:ListRoleTags",
|
|
||||||
"iam:ListUsers",
|
|
||||||
"iam:ListAccountAliases"
|
|
||||||
],
|
|
||||||
"Resource": "*",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Sid": "AllowReadOnlyIAMUse"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Action": [
|
|
||||||
"iam:CreatePolicy",
|
|
||||||
"iam:ListPolicyVersions",
|
|
||||||
"iam:ListEntitiesForPolicy",
|
|
||||||
"iam:DeletePolicy"
|
|
||||||
],
|
|
||||||
"Resource": "arn:aws:iam::{{ aws_account }}:policy/ansible-test-*",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Sid": "AllowManagementOfSpecificPolicies"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Action": [
|
|
||||||
"iam:AttachRolePolicy",
|
|
||||||
"iam:CreateRole",
|
|
||||||
"iam:DeleteRole",
|
|
||||||
"iam:DeleteRolePolicy",
|
|
||||||
"iam:DeleteRolePermissionsBoundary",
|
|
||||||
"iam:DetachRolePolicy",
|
|
||||||
"iam:PutRolePolicy",
|
|
||||||
"iam:PassRole",
|
|
||||||
"iam:PutRolePolicy",
|
|
||||||
"iam:PutRolePermissionsBoundary",
|
|
||||||
"iam:TagRole",
|
|
||||||
"iam:UntagRole",
|
|
||||||
"iam:UpdateAssumeRolePolicy",
|
|
||||||
"iam:UpdateRole",
|
|
||||||
"iam:UpdateRoleDescription",
|
|
||||||
"sts:AssumeRole"
|
|
||||||
],
|
|
||||||
"Resource": "arn:aws:iam::{{ aws_account }}:role/ansible-test-*",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Sid": "AllowUpdateOfSpecificRoles"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Action": [
|
|
||||||
"iam:CreateInstanceProfile",
|
|
||||||
"iam:DeleteInstanceProfile",
|
|
||||||
"iam:AddRoleToInstanceProfile",
|
|
||||||
"iam:RemoveRoleFromInstanceProfile"
|
|
||||||
],
|
|
||||||
"Resource": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Sid": "AllowUpdateOfSpecificInstanceProfiles"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Action": [
|
|
||||||
"ec2:ReplaceIamInstanceProfileAssociation"
|
|
||||||
],
|
|
||||||
"Resource": "*",
|
|
||||||
"Condition": {
|
|
||||||
"ArnEquals": {
|
|
||||||
"ec2:InstanceProfile": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Sid": "AllowReplacementOfSpecificInstanceProfiles"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowWAFusage",
|
|
||||||
"Action": "waf:*",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowListingCloudwatchLogs",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"logs:DescribeLogGroups"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowModifyingCloudtrail",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"cloudtrail:*"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:cloudtrail:{{aws_region}}:{{aws_account}}:trail/ansible-test-*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowDescribingCloudtrails",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"cloudtrail:DescribeTrails",
|
|
||||||
"cloudtrail:ListTags",
|
|
||||||
"cloudtrail:ListPublicKeys"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowModifyingCloudwatchLogs",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"logs:CreateLogGroup",
|
|
||||||
"logs:PutRetentionPolicy",
|
|
||||||
"logs:DeleteLogGroup"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-test*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAccessToUnspecifiedKMSResources",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"kms:CancelKeyDeletion",
|
|
||||||
"kms:CreateAlias",
|
|
||||||
"kms:CreateGrant",
|
|
||||||
"kms:CreateKey",
|
|
||||||
"kms:DeleteAlias",
|
|
||||||
"kms:Describe*",
|
|
||||||
"kms:DisableKey",
|
|
||||||
"kms:EnableKey",
|
|
||||||
"kms:GenerateRandom",
|
|
||||||
"kms:Get*",
|
|
||||||
"kms:List*",
|
|
||||||
"kms:PutKeyPolicy",
|
|
||||||
"kms:RetireGrant",
|
|
||||||
"kms:ScheduleKeyDeletion",
|
|
||||||
"kms:TagResource",
|
|
||||||
"kms:UntagResource",
|
|
||||||
"kms:UpdateGrant",
|
|
||||||
"kms:UpdateKeyDescription"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAccessToServerCertificates",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"iam:*ServerCertificates",
|
|
||||||
"iam:*ServerCertificate"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAccessToSecrets",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"secretsmanager:*"
|
|
||||||
],
|
|
||||||
"Resource": "arn:aws:secretsmanager:{{aws_region}}:{{aws_account}}:secret:ansible-test*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAccessToManagePasswordPolicy",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"iam:*AccountPasswordPolicy"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAccessToManageUsersAndGroups",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"iam:*Group",
|
|
||||||
"iam:*User",
|
|
||||||
"iam:ListAttachedGroupPolicies"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:iam::{{ aws_account }}:user/ansible-test*",
|
|
||||||
"arn:aws:iam::{{ aws_account }}:group/ansible-test*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAccessToACMRestrictable",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"acm:ImportCertificate",
|
|
||||||
"acm:DescribeCertificate",
|
|
||||||
"acm:GetCertificate",
|
|
||||||
"acm:AddTagsToCertificate",
|
|
||||||
"acm:DeleteCertificate"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:acm:{{aws_region}}:{{aws_account}}:certificate/*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowAccessToACMUnrestrictable",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"acm:ListCertificates",
|
|
||||||
"acm:ListTagsForCertificate"
|
|
||||||
],
|
|
||||||
"Resource": [
|
|
||||||
"*"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
@ -1,54 +0,0 @@
|
||||||
{
|
|
||||||
"Version": "2012-10-17",
|
|
||||||
"Statement": [
|
|
||||||
{
|
|
||||||
"Sid": "AllowS3AnsibleTestBuckets",
|
|
||||||
"Action": [
|
|
||||||
"s3:CreateBucket",
|
|
||||||
"s3:Delete*",
|
|
||||||
"s3:GetBucketAcl",
|
|
||||||
"s3:GetBucketLogging",
|
|
||||||
"s3:GetBucketNotification",
|
|
||||||
"s3:GetBucketPolicy",
|
|
||||||
"s3:GetBucketRequestPayment",
|
|
||||||
"s3:GetBucketTagging",
|
|
||||||
"s3:GetBucketVersioning",
|
|
||||||
"s3:GetEncryptionConfiguration",
|
|
||||||
"s3:GetObject",
|
|
||||||
"s3:HeadBucket",
|
|
||||||
"s3:List*",
|
|
||||||
"s3:PutBucketAcl",
|
|
||||||
"s3:PutBucketLogging",
|
|
||||||
"s3:PutBucketNotification",
|
|
||||||
"s3:PutBucketPolicy",
|
|
||||||
"s3:PutBucketRequestPayment",
|
|
||||||
"s3:PutBucketTagging",
|
|
||||||
"s3:PutBucketVersioning",
|
|
||||||
"s3:PutEncryptionConfiguration",
|
|
||||||
"s3:PutObject",
|
|
||||||
"s3:PutObjectAcl"
|
|
||||||
],
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Resource": [
|
|
||||||
"arn:aws:s3:::ansible-test-*",
|
|
||||||
"arn:aws:s3:::ansible-test-*/*"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "AllowListingS3Buckets",
|
|
||||||
"Action": [
|
|
||||||
"s3:ListAllMyBuckets"
|
|
||||||
],
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Resource": "*"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Sid": "ManageEFS",
|
|
||||||
"Effect": "Allow",
|
|
||||||
"Action": [
|
|
||||||
"elasticfilesystem:*"
|
|
||||||
],
|
|
||||||
"Resource": "*"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
Loading…
Reference in a new issue