cloud optix のcloudformation stackの実行に必要な権限

gistfile1.txt

				"elasticfilesystem:DescribeMountTargetSecurityGroups",
				"elasticfilesystem:DescribeMountTargets",
				"sns:ListSubscriptions",
				"s3:GetAccountPublicAccessBlock",
				"ce:GetCostAndUsage",
				"ce:GetCostForecast",
				"ce:GetUsageForecast",
				"eks:List*",
				"detective:ListGraphs",
				"ec2:SearchTransitGatewayRoutes",
				"ec2:GetTransitGatewayRouteTableAssociations",
				"support:DescribeTrustedAdvisorCheckResult",
				"support:RefreshTrustedAdvisorCheck",
				"cloudformation:List*",
				"cloudformation:Get*",
				"cloudformation:CreateStack",
				"cloudformation:Describe*",
				"cloudformation:DeleteStack",
				"iam:*",
				"lambda:Get*",
				"lambda:List*",
				"lambda:CreateFunction",
				"lambda:DeleteFunction",
				"lambda:GetAccountSettings",
				"s3:GetObject",
				"kms:*",
				"lambda:InvokeFunction"

https://docs.sophos.com/pcg/optix/help/en-us/pcg/optix/concepts/AWSScript.html

まるっと全拒否からやろうと思うと上記にあるだけではたりなかった

cloud optixからのAPI Syncには全然足りない

これぐらい許可してやればとりあえずAPI Syncは成功した

				"elasticfilesystem:Describe*",
				"elasticfilesystem:Get*",
				"elasticfilesystem:List*",
				"sns:ListSubscriptions",
				"s3:GetAccountPublicAccessBlock",
				"ce:*",
				"eks:List*",
				"detective:ListGraphs",
				"ec2:SearchTransitGatewayRoutes",
				"ec2:GetTransitGatewayRouteTableAssociations",
				"support:DescribeTrustedAdvisorCheckResult",
				"support:RefreshTrustedAdvisorCheck",
				"cloudformation:List*",
				"cloudformation:Get*",
				"cloudformation:CreateStack",
				"cloudformation:Describe*",
				"cloudformation:DeleteStack",
				"iam:*",
				"lambda:Get*",
				"lambda:List*",
				"lambda:CreateFunction",
				"lambda:DeleteFunction",
				"lambda:GetAccountSettings",
				"s3:GetObject",
				"kms:*",
				"lambda:InvokeFunction",
				"access-analyzer:Get*",
				"access-analyzer:List*",
				"acm:*",
				"application-autoscaling:Describe*",
				"autoscaling:Describe*",
				"chime:*",
				"cloud9:Describe*",
				"cloudfront:*",
				"cloudtrail:List*",
				"cloudtrail:Get*",
				"cloudtrail:Describe*",
				"cloudsearch:Describe*",
				"cloudwatch:Describe*",
				"cognito-idp:Describe*",
				"cognito-idp:List*",
				"cognito-sync:Describe*",
				"cognito-sync:List*",
				"config:*",
				"datasync:Describe*",
				"datasync:List*",
				"dax:Describe*",
				"detective:Get*",
				"detective:List*",
				"directconnect:*",
				"dms:Describe*",
				"dynamodb:Describe*",
				"dynamodb:List*",
				"ec2:Describe*",
				"ec2:Get*",
				"ecr-public:Describe*",
				"ecr-public:Get*",
				"ecr:Describe*",
				"ecr:Get*",
				"ecr:List*",
				"ecs:List*",
				"eks:Describe*",
				"eks:List*",
				"elasticache:Describe*",
				"elasticloadbalancing:Describe*",
				"elasticmapreduce:Describe*",
				"es:Describe*",
				"es:List*",
				"events:Describe*",
				"events:List*",
				"firehose:Describe*",
				"firehose:List*",
				"fms:*",
				"fsx:List*",
				"globalaccelerator:*",
				"glue:Get*",
				"guardduty:Get*",
				"guardduty:List*",
				"iam:*",
				"inspector:Describe*",
				"inspector:Get*",
				"inspector:List*",
				"inspector:Preview*",
				"kinesis:Describe*",
				"kinesis:List*",
				"kms:*",
				"lambda:Get*",
				"lambda:List*",
				"license-manager:List*",
				"logs:Describe*",
				"organizations:*",
				"quicksight:Describe*",
				"quicksight:List*",
				"ram:List*",
				"rds:Describe*",
				"route53:*",
				"route53domains:*",
				"route53resolver:Get*",
				"route53resolver:List*",
				"s3:Get*",
				"s3:List*",
				"schemas:Describe*",
				"schemas:List*",
				"secretsmanager:Describe*",
				"secretsmanager:Get*",
				"secretsmanager:List*",
				"securityhub:Describe*",
				"securityhub:Get*",
				"securityhub:List*",
				"serverlessrepo:Get*",
				"serverlessrepo:List*",
				"servicequotas:Get*",
				"servicequotas:List*",
				"ses:Get*",
				"ses:List*",
				"shield:*",
				"sns:Get*",
				"sns:List*",
				"sqs:Get*",
				"sqs:List*",
				"ssm:Describe*",
				"ssm:Get*",
				"ssm:List*",
				"support:*",
				"transfer:Describe*",
				"transfer:List*",
				"trustedadvisor:Describe*"