4ee9f40e62
* convert aws_acm_facts to AnsibleAWSModule * factor aws_acm_facts into module_utils * add more filtering options for aws_acm_info * add aws_acm module and tests * uncomment aws_acm test * fix linting for aws_acm * fix __future__ linting for aws_acm * fix linting for aws_acm * fix linting for aws_acm * fix linting for aws_acm * fix linting for aws_acm * fix aws_acm_info arg type * remove test for old module name aws_acm_facts * simplify AWS ACM client creation * fix indent typo in aws_acm test * catch BotoCoreError in aws_acm * fix indent typo in aws_acm test * tighten AWS ACM test policy resource * move aws acm int test to venv * remove errant file * fix AWS ACM int test perms * undo copyright addition to wrong file * fix invalid log message in aws_acm Co-Authored-By: Jill R <4121322+jillr@users.noreply.github.com> * rephrase aws_acm_info doc from facts to information Co-Authored-By: Jill R <4121322+jillr@users.noreply.github.com> * rename aws_facts var to aws_info * remove case insensitivity for aws_acm pem compare * add no_log for aws_acm credential setting * add per-test prefix to aws_acm test resource names * make aws_acm use crypto module_util * clarify copyright for aws_acm * make aws_acm int test clearer * add explicit crypto dependency to aws_acm * change requests for aws_acm pr * fix wrong copyright owner aws_acm test * fix wrong copyright owner aws_acm test * rewrite aws_acm cert chain compare with regex, no dependency * fix linting for aws_acm unit test * fix linting for aws_acm unit test * fix linting and duplicate ignore * fix failed cert chain split in aws_acm, add more tests * remove errant file * more linting fixes for aws_acm * fix sanity ignore * rewrite cert compare in aws_acm to use base64 decode * improve regex for pem cert chain split in aws_acm * undo changes to crypto module util for aws_acm * increment ansible version for new aws_acm module * convert aws_acm return(x) to return x * increment version added for aws_acm_info new features * fix linting * fix bugs with AWS ACM * fix bad rebase * disable AWS ACM integration test, due to AWS account limit issue * remove aws acm integration test from shippable group
225 lines
7 KiB
JSON
225 lines
7 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"iam:GetGroup",
|
|
"iam:GetInstanceProfile",
|
|
"iam:CreateInstanceProfile",
|
|
"iam:GetPolicy",
|
|
"iam:GetPolicyVersion",
|
|
"iam:GetRole",
|
|
"iam:GetRolePolicy",
|
|
"iam:GetUser",
|
|
"iam:ListAttachedGroupPolicies",
|
|
"iam:ListAttachedRolePolicies",
|
|
"iam:ListAttachedUserPolicies",
|
|
"iam:ListGroups",
|
|
"iam:ListInstanceProfiles",
|
|
"iam:ListInstanceProfilesForRole",
|
|
"iam:ListPolicies",
|
|
"iam:ListRoles",
|
|
"iam:ListRolePolicies",
|
|
"iam:ListUsers",
|
|
"iam:ListAccountAliases"
|
|
],
|
|
"Resource": "*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowReadOnlyIAMUse"
|
|
},
|
|
{
|
|
"Action": [
|
|
"iam:CreatePolicy",
|
|
"iam:ListPolicyVersions",
|
|
"iam:ListEntitiesForPolicy",
|
|
"iam:DeletePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::{{ aws_account }}:policy/ansible-test-*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowManagementOfSpecificPolicies"
|
|
},
|
|
{
|
|
"Action": [
|
|
"iam:AttachRolePolicy",
|
|
"iam:CreateRole",
|
|
"iam:DeleteRole",
|
|
"iam:DeleteRolePolicy",
|
|
"iam:DeleteRolePermissionsBoundary",
|
|
"iam:DetachRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:PassRole",
|
|
"iam:PutRolePolicy",
|
|
"iam:PutRolePermissionsBoundary",
|
|
"iam:UpdateAssumeRolePolicy",
|
|
"iam:UpdateRole",
|
|
"iam:UpdateRoleDescription",
|
|
"sts:AssumeRole"
|
|
],
|
|
"Resource": "arn:aws:iam::{{ aws_account }}:role/ansible-test-*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowUpdateOfSpecificRoles"
|
|
},
|
|
{
|
|
"Action": [
|
|
"iam:CreateInstanceProfile",
|
|
"iam:DeleteInstanceProfile",
|
|
"iam:AddRoleToInstanceProfile",
|
|
"iam:RemoveRoleFromInstanceProfile"
|
|
],
|
|
"Resource": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowUpdateOfSpecificInstanceProfiles"
|
|
},
|
|
{
|
|
"Action": [
|
|
"ec2:ReplaceIamInstanceProfileAssociation"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"ArnEquals": {
|
|
"ec2:InstanceProfile": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*"
|
|
}
|
|
},
|
|
"Effect": "Allow",
|
|
"Sid": "AllowReplacementOfSpecificInstanceProfiles"
|
|
},
|
|
{
|
|
"Sid": "AllowWAFusage",
|
|
"Action": "waf:*",
|
|
"Effect": "Allow",
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowListingCloudwatchLogs",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:DescribeLogGroups"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowModifyingCloudtrail",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"cloudtrail:*"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:cloudtrail:{{aws_region}}:{{aws_account}}:trail/ansible-test-*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowDescribingCloudtrails",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"cloudtrail:DescribeTrails",
|
|
"cloudtrail:ListTags",
|
|
"cloudtrail:ListPublicKeys"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowModifyingCloudwatchLogs",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:CreateLogGroup",
|
|
"logs:PutRetentionPolicy",
|
|
"logs:DeleteLogGroup"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-test*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToUnspecifiedKMSResources",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"kms:CancelKeyDeletion",
|
|
"kms:CreateAlias",
|
|
"kms:CreateGrant",
|
|
"kms:CreateKey",
|
|
"kms:DeleteAlias",
|
|
"kms:Describe*",
|
|
"kms:DisableKey",
|
|
"kms:EnableKey",
|
|
"kms:GenerateRandom",
|
|
"kms:Get*",
|
|
"kms:List*",
|
|
"kms:PutKeyPolicy",
|
|
"kms:RetireGrant",
|
|
"kms:ScheduleKeyDeletion",
|
|
"kms:TagResource",
|
|
"kms:UntagResource",
|
|
"kms:UpdateGrant",
|
|
"kms:UpdateKeyDescription"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToServerCertificates",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:*ServerCertificates",
|
|
"iam:*ServerCertificate"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToSecrets",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"secretsmanager:*"
|
|
],
|
|
"Resource": "arn:aws:secretsmanager:{{aws_region}}:{{aws_account}}:secret:ansible-test*"
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToManagePasswordPolicy",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:*AccountPasswordPolicy"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToManageUsersAndGroups",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:*Group",
|
|
"iam:*User",
|
|
"iam:ListAttachedGroupPolicies"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:iam::{{ aws_account }}:user/ansible-test*",
|
|
"arn:aws:iam::{{ aws_account }}:group/ansible-test*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToACMRestrictable",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"acm:ImportCertificate",
|
|
"acm:DescribeCertificate",
|
|
"acm:GetCertificate",
|
|
"acm:AddTagsToCertificate",
|
|
"acm:DeleteCertificate"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:acm:{{aws_region}}:{{aws_account}}:certificate/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToACMUnrestrictable",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"acm:ListCertificates",
|
|
"acm:ListTagsForCertificate"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
}
|
|
]
|
|
}
|