60fb9fc208
* Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes
130 lines
4.1 KiB
JSON
130 lines
4.1 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"iam:GetGroup",
|
|
"iam:GetInstanceProfile",
|
|
"iam:CreateInstanceProfile",
|
|
"iam:GetPolicy",
|
|
"iam:GetPolicyVersion",
|
|
"iam:GetRole",
|
|
"iam:GetRolePolicy",
|
|
"iam:GetUser",
|
|
"iam:ListAttachedGroupPolicies",
|
|
"iam:ListAttachedRolePolicies",
|
|
"iam:ListAttachedUserPolicies",
|
|
"iam:ListGroups",
|
|
"iam:ListInstanceProfiles",
|
|
"iam:ListInstanceProfilesForRole",
|
|
"iam:ListPolicies",
|
|
"iam:ListRoles",
|
|
"iam:ListRolePolicies",
|
|
"iam:ListUsers",
|
|
"iam:ListAccountAliases"
|
|
],
|
|
"Resource": "*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowReadOnlyIAMUse"
|
|
},
|
|
{
|
|
"Action": [
|
|
"iam:AttachRolePolicy",
|
|
"iam:CreateRole",
|
|
"iam:DeleteRole",
|
|
"iam:DetachRolePolicy",
|
|
"iam:PassRole",
|
|
"iam:UpdateAssumeRolePolicy",
|
|
"sts:AssumeRole"
|
|
],
|
|
"Resource": "arn:aws:iam::{{ aws_account }}:role/ansible-test-*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowUpdateOfSpecificRoles"
|
|
},
|
|
{
|
|
"Action": [
|
|
"iam:CreateInstanceProfile",
|
|
"iam:DeleteInstanceProfile",
|
|
"iam:AddRoleToInstanceProfile",
|
|
"iam:RemoveRoleFromInstanceProfile"
|
|
],
|
|
"Resource": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowUpdateOfSpecificInstanceProfiles"
|
|
},
|
|
{
|
|
"Action": [
|
|
"ec2:ReplaceIamInstanceProfileAssociation"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"ArnEquals": {
|
|
"ec2:InstanceProfile": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*"
|
|
}
|
|
},
|
|
"Effect": "Allow",
|
|
"Sid": "AllowReplacementOfSpecificInstanceProfiles"
|
|
},
|
|
{
|
|
"Sid": "AllowWAFusage",
|
|
"Action": "waf:*",
|
|
"Effect": "Allow",
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowListingCloudwatchLogs",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:DescribeLogGroups"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowModifyingCloudwatchLogs",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:CreateLogGroup",
|
|
"logs:PutRetentionPolicy",
|
|
"logs:DeleteLogGroup"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-testing*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToUnspecifiedKMSResources",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"kms:CancelKeyDeletion",
|
|
"kms:CreateAlias",
|
|
"kms:CreateGrant",
|
|
"kms:CreateKey",
|
|
"kms:DeleteAlias",
|
|
"kms:Describe*",
|
|
"kms:DisableKey",
|
|
"kms:EnableKey",
|
|
"kms:GenerateRandom",
|
|
"kms:Get*",
|
|
"kms:List*",
|
|
"kms:RetireGrant",
|
|
"kms:ScheduleKeyDeletion",
|
|
"kms:TagResource",
|
|
"kms:UntagResource",
|
|
"kms:UpdateGrant",
|
|
"kms:UpdateKeyDescription"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToServerCertificates",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:ListServerCertificates",
|
|
"iam:UploadServerCertificate"
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|