da30e6d2e1
* reworked sqs_queue * Switch default purge_tags behaviour to false. This matches the behaviour of ec2_tag and ecs_tag. * Minor lint / review fixups * Add missing AWS IAM policy for SQS tests * Move integration tests to using module_defaults: group/aws:... * add changelog * Break out the 'compatability' map from our spec definition (gets flagged by the schema validation) * Tweaks based on review * add basic examples * Lint fixups * Switch out NonExistentQueue logic so it's easier to follow * Reorder name argument options for consistency Co-authored-by: Dennis Podkovyrin <dennis.podkovyrin@gmail.com>
280 lines
10 KiB
JSON
280 lines
10 KiB
JSON
{# Not all Autoscaling API Actions allow specified resources #}
|
|
{# See http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources #}
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "DescribeAutoscaling",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"autoscaling:DescribeAutoScalingGroups",
|
|
"autoscaling:DescribeLaunchConfigurations",
|
|
"autoscaling:DescribePolicies"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowAutoscaling",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"autoscaling:*LaunchConfiguration",
|
|
"autoscaling:*LoadBalancers",
|
|
"autoscaling:*AutoScalingGroup",
|
|
"autoscaling:*MetricsCollection",
|
|
"autoscaling:PutScalingPolicy",
|
|
"autoscaling:DeletePolicy",
|
|
"autoscaling:*Tags"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:autoscaling:{{aws_region}}:{{aws_account}}:*"
|
|
]
|
|
},
|
|
{# Note that not all EC2 API Actions allow a specific resource #}
|
|
{# See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions #}
|
|
{
|
|
"Sid": "AllowUnspecifiedEC2Resource",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:*LaunchTemplate",
|
|
"ec2:*LaunchTemplateVersion",
|
|
"ec2:*LaunchTemplateVersions",
|
|
"ec2:AttachVolume",
|
|
"ec2:CreateImage",
|
|
"ec2:CreateKeyPair",
|
|
"ec2:CreateSecurityGroup",
|
|
"ec2:CreateSnapshot",
|
|
"ec2:CreateTags",
|
|
"ec2:DeleteKeyPair",
|
|
"ec2:DeleteSnapshot",
|
|
"ec2:DeleteTags",
|
|
"ec2:DeregisterImage",
|
|
"ec2:Describe*",
|
|
"ec2:DetachVolume",
|
|
"ec2:ImportKeyPair",
|
|
"ec2:ModifyImageAttribute",
|
|
"ec2:ModifyInstanceAttribute",
|
|
"ec2:RegisterImage",
|
|
"ec2:ReplaceIamInstanceProfileAssociation",
|
|
"ec2:ReportInstanceStatus"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowSpecifiedEC2Resource",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:AuthorizeSecurityGroupIngress",
|
|
"ec2:AuthorizeSecurityGroupEgress",
|
|
"ec2:CreateTags",
|
|
"ec2:CreateVolume",
|
|
"ec2:DeleteRouteTable",
|
|
"ec2:DeleteSecurityGroup",
|
|
"ec2:DeleteVolume",
|
|
"ec2:RevokeSecurityGroupEgress",
|
|
"ec2:RevokeSecurityGroupIngress",
|
|
"ec2:RunInstances",
|
|
"ec2:StartInstances",
|
|
"ec2:StopInstances",
|
|
"ec2:TerminateInstances",
|
|
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
|
|
"ec2:UpdateSecurityGroupRuleDescriptionsEgress"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:ec2:{{aws_region}}::image/*",
|
|
"arn:aws:ec2:{{aws_region}}:{{aws_account}}:*"
|
|
]
|
|
},
|
|
{# According to http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html #}
|
|
{# Resource level access control is not possible for the new ELB API (providing Application Load Balancer functionality #}
|
|
{# While it remains possible for the old API, there is no distinction of the Actions between old API and new API #}
|
|
{
|
|
"Sid": "AllowLoadBalancerOperations",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:*LoadBalancer",
|
|
"elasticloadbalancing:*LoadBalancers",
|
|
"elasticloadbalancing:*LoadBalancerListeners",
|
|
"elasticloadbalancing:*TargetGroup",
|
|
"elasticloadbalancing:AddTags",
|
|
"elasticloadbalancing:ConfigureHealthCheck",
|
|
"elasticloadbalancing:Create*",
|
|
"elasticloadbalancing:Delete*",
|
|
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
|
|
"elasticloadbalancing:Describe*",
|
|
"elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer",
|
|
"elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer",
|
|
"elasticloadbalancing:Modify*",
|
|
"elasticloadbalancing:Register*",
|
|
"elasticloadbalancing:Deregister*",
|
|
"elasticloadbalancing:Remove*"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{# Only certain lambda actions can be restricted to a specific resource #}
|
|
{# http://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html #}
|
|
{
|
|
"Sid": "AllowApiGateway",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"apigateway:*"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:apigateway:{{aws_region}}::/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowGetUserForLambdaCreation",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetUser"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:iam::{{aws_account}}:user/ansible_integration_tests"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowLambdaManagementWithoutResource",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"lambda:CreateEventSourceMapping",
|
|
"lambda:GetAccountSettings",
|
|
"lambda:GetEventSourceMapping",
|
|
"lambda:List*",
|
|
"lambda:TagResource",
|
|
"lambda:UntagResource"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowLambdaManagementWithResource",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"lambda:AddPermission",
|
|
"lambda:CreateAlias",
|
|
"lambda:CreateFunction",
|
|
"lambda:DeleteAlias",
|
|
"lambda:DeleteFunction",
|
|
"lambda:GetAlias",
|
|
"lambda:GetFunction",
|
|
"lambda:GetFunctionConfiguration",
|
|
"lambda:GetPolicy",
|
|
"lambda:InvokeFunction",
|
|
"lambda:PublishVersion",
|
|
"lambda:RemovePermission",
|
|
"lambda:UpdateAlias",
|
|
"lambda:UpdateEventSourceMapping",
|
|
"lambda:UpdateFunctionCode",
|
|
"lambda:UpdateFunctionConfiguration"
|
|
],
|
|
"Resource": "arn:aws:lambda:{{aws_region}}:{{aws_account}}:function:*"
|
|
},
|
|
{
|
|
"Sid": "AllowRoleManagement",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:PassRole"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:iam::{{aws_account}}:role/ansible_lambda_role",
|
|
"arn:aws:iam::{{aws_account}}:role/ecsInstanceRole",
|
|
"arn:aws:iam::{{aws_account}}:role/ec2InstanceRole",
|
|
"arn:aws:iam::{{aws_account}}:role/ecsServiceRole",
|
|
"arn:aws:iam::{{aws_account}}:role/aws_eks_cluster_role",
|
|
"arn:aws:iam::{{aws_account}}:role/ecsTaskExecutionRole"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowSESManagement",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ses:VerifyEmailIdentity",
|
|
"ses:DeleteIdentity",
|
|
"ses:GetIdentityVerificationAttributes",
|
|
"ses:GetIdentityNotificationAttributes",
|
|
"ses:VerifyDomainIdentity",
|
|
"ses:SetIdentityNotificationTopic",
|
|
"ses:SetIdentityHeadersInNotificationsEnabled",
|
|
"ses:SetIdentityFeedbackForwardingEnabled",
|
|
"ses:GetIdentityPolicies",
|
|
"ses:PutIdentityPolicy",
|
|
"ses:DeleteIdentityPolicy",
|
|
"ses:ListIdentityPolicies",
|
|
"ses:SetIdentityFeedbackForwardingEnabled",
|
|
"ses:ListReceiptRuleSets",
|
|
"ses:DescribeReceiptRuleSet",
|
|
"ses:DescribeActiveReceiptRuleSet",
|
|
"ses:SetActiveReceiptRuleSet",
|
|
"ses:CreateReceiptRuleSet",
|
|
"ses:DeleteReceiptRuleSet"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowSNSManagement",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"SNS:CreateTopic",
|
|
"SNS:DeleteTopic",
|
|
"SNS:GetTopicAttributes",
|
|
"SNS:ListSubscriptions",
|
|
"SNS:ListSubscriptionsByTopic",
|
|
"SNS:ListTopics",
|
|
"SNS:SetTopicAttributes",
|
|
"SNS:Subscribe",
|
|
"SNS:Unsubscribe"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowStepFunctionsStateMachine",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"states:CreateStateMachine",
|
|
"states:DeleteStateMachine",
|
|
"states:DescribeExecution",
|
|
"states:DescribeStateMachine",
|
|
"states:ListExecutions",
|
|
"states:ListStateMachines",
|
|
"states:ListTagsForResource",
|
|
"states:StartExecution",
|
|
"states:StopExecution",
|
|
"states:TagResource",
|
|
"states:UntagResource",
|
|
"states:UpdateStateMachine"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:states:*:*:*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowLightsail",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"lightsail:CreateInstances",
|
|
"lightsail:DeleteInstance",
|
|
"lightsail:GetInstance",
|
|
"lightsail:GetInstances",
|
|
"lightsail:RebootInstance",
|
|
"lightsail:StartInstance",
|
|
"lightsail:StopInstance"
|
|
],
|
|
"Resource": "arn:aws:lightsail:*:*:*"
|
|
},
|
|
{
|
|
"Sid": "AllowSQS",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"sqs:GetQueueURL",
|
|
"sqs:CreateQueue",
|
|
"sqs:GetQueueAttributes",
|
|
"sqs:DeleteQueue",
|
|
"sqs:SetQueueAttributes"
|
|
],
|
|
"Resource": "arn:aws:sqs:*:*:*"
|
|
},
|
|
]
|
|
}
|