Stratalux_RW

Stratalux_RW.json

{
    "Statement": [
        {

#
#Setup explicit deny for specific actions that we don't want Stratalux employees to do.
#

            "Action": [
                "iam:CreateGroup",
                "iam:DeleteGroup",
                "iam:DeleteGroupPolicy",
                "iam:GetAccountSummary",
                "iam:PutGroupPolicy",
                "iam:PutUserPolicy",
                "iam:UpdateGroup",
                "iam:ListAccountAliases",
                "iam:CreateAccountAliases",
                "iam:DeleteAccountAliases",
                "ec2:CancelSpotInstanceRequests",
                "ec2:CreateSpotDatafeedSubscription",
                "ec2:DeleteSpotDatafeedSubscription",
                "ec2:DescribeReservedInstances",
                "ec2:DescribeReservedInstancesOfferings",
                "ec2:DescribeSpotDatafeedSubscription",
                "ec2:DescribeSpotInstanceRequests",
                "ec2:DescribeSpotPriceHistory",
                "ec2:PurchaseReservedInstancesOffering",
                "ec2:RequestSpotInstances"
            ],
            "Effect": "Deny",
            "Resource": [
                "*"
            ]
        },
        {

#
# Allow everything except these actions on our IAM groups.
#
            "NotAction": [
                "iam:GetGroup",
                "iam:ListGroupPolicies"
            ],
            "Effect": "Deny",
            "Resource": [
                "arn:aws:iam::*:group/Stratalux_*",
                "arn:aws:iam::*:group/Customer_Admin"
            ]
        },
        {

#
# Allow everything else that is not IAM.
#
            "NotAction": "iam:*",
            "Effect": "Allow",
            "Resource": "*"
        },
        {

#
# Allow everything else that's not explicitly denied above.
#

            "Action": [
                "*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ]
        }
    ]
}