924352a051
* Combine testing policies Because of the maximum of 10 policies per group, need to consolidate testing policies as best we can. * Tidy put-account-setting tasks and add permission Using `environment` and `command` rather than `shell` avoids the need for `no_log` and means that people can fix the problem * refactor ecs_cluster test suite move from runme.sh technique to virtualenv use ec2_instance rather than ec2 module to avoid need for boto
157 lines
5 KiB
JSON
157 lines
5 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"iam:GetGroup",
|
|
"iam:GetInstanceProfile",
|
|
"iam:CreateInstanceProfile",
|
|
"iam:GetPolicy",
|
|
"iam:GetPolicyVersion",
|
|
"iam:GetRole",
|
|
"iam:GetRolePolicy",
|
|
"iam:GetUser",
|
|
"iam:ListAttachedGroupPolicies",
|
|
"iam:ListAttachedRolePolicies",
|
|
"iam:ListAttachedUserPolicies",
|
|
"iam:ListGroups",
|
|
"iam:ListInstanceProfiles",
|
|
"iam:ListInstanceProfilesForRole",
|
|
"iam:ListPolicies",
|
|
"iam:ListRoles",
|
|
"iam:ListRolePolicies",
|
|
"iam:ListUsers",
|
|
"iam:ListAccountAliases"
|
|
],
|
|
"Resource": "*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowReadOnlyIAMUse"
|
|
},
|
|
{
|
|
"Action": [
|
|
"iam:AttachRolePolicy",
|
|
"iam:CreateRole",
|
|
"iam:DeleteRole",
|
|
"iam:DetachRolePolicy",
|
|
"iam:PassRole"
|
|
],
|
|
"Resource": "arn:aws:iam::{{ aws_account }}:role/ansible-test-*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowUpdateOfSpecificRoles"
|
|
},
|
|
{
|
|
"Action": [
|
|
"iam:CreateInstanceProfile",
|
|
"iam:DeleteInstanceProfile",
|
|
"iam:AddRoleToInstanceProfile",
|
|
"iam:RemoveRoleFromInstanceProfile"
|
|
],
|
|
"Resource": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*",
|
|
"Effect": "Allow",
|
|
"Sid": "AllowUpdateOfSpecificInstanceProfiles"
|
|
},
|
|
{
|
|
"Action": [
|
|
"ec2:ReplaceIamInstanceProfileAssociation"
|
|
],
|
|
"Resource": "*",
|
|
"Condition": {
|
|
"ArnEquals": {
|
|
"ec2:InstanceProfile": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*"
|
|
}
|
|
},
|
|
"Effect": "Allow",
|
|
"Sid": "AllowReplacementOfSpecificInstanceProfiles"
|
|
},
|
|
{
|
|
"Sid": "AllowWAFusage",
|
|
"Action": "waf:*",
|
|
"Effect": "Allow",
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowListingCloudwatchLogs",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:DescribeLogGroups"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowModifyingCloudwatchLogs",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:CreateLogGroup",
|
|
"logs:PutRetentionPolicy",
|
|
"logs:DeleteLogGroup"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-testing*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowSTSAnsibleTests",
|
|
"Action": [
|
|
"iam:CreateRole",
|
|
"iam:DeleteRole",
|
|
"iam:DetachRolePolicy",
|
|
"sts:AssumeRole",
|
|
"iam:AttachRolePolicy",
|
|
"iam:CreateInstanceProfile"
|
|
],
|
|
"Effect": "Allow",
|
|
"Resource": [
|
|
"arn:aws:iam::{{aws_account}}:role/ansible-test-sts-*",
|
|
"arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-sts-*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToUnspecifiedKMSResources",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"kms:CancelKeyDeletion",
|
|
"kms:CreateAlias",
|
|
"kms:CreateGrant",
|
|
"kms:CreateKey",
|
|
"kms:DeleteAlias",
|
|
"kms:Describe*",
|
|
"kms:DisableKey",
|
|
"kms:EnableKey",
|
|
"kms:GenerateRandom",
|
|
"kms:Get*",
|
|
"kms:List*",
|
|
"kms:RetireGrant",
|
|
"kms:ScheduleKeyDeletion",
|
|
"kms:TagResource",
|
|
"kms:UntagResource",
|
|
"kms:UpdateGrant",
|
|
"kms:UpdateKeyDescription"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowAccessToSpecifiedIAMResources",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:CreateRole",
|
|
"iam:DeleteRole",
|
|
"iam:GetRole",
|
|
"iam:PassRole",
|
|
"iam:UpdateAssumeRolePolicy"
|
|
],
|
|
"Resource": "arn:aws:iam::{{aws_account}}:role/ansible-test-*"
|
|
},
|
|
{
|
|
"Sid": "AllowInstanceProfileCreation",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:AddRoleToInstanceProfile",
|
|
"iam:CreateInstanceProfile",
|
|
"iam:RemoveRoleFromInstanceProfile"
|
|
],
|
|
"Resource": "arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-*"
|
|
}
|
|
]
|
|
}
|