Skip to content

Instantly share code, notes, and snippets.

@vaibhavpandeyvpz

vaibhavpandeyvpz/00-common-aws-policies.md

Last active February 22, 2022 05:01
Download ZIP

Revisions

  1. vaibhavpandeyvpz revised this gist Feb 22, 2022. 1 changed file with 10 additions and 0 deletions.
    10 changes: 10 additions & 0 deletions ses-send-only.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,10 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "ses:SendRawEmail",
    "Resource": "*"
    }
    ]
    }
  2. vaibhavpandeyvpz revised this gist Jan 7, 2022. 3 changed files with 9 additions and 3 deletions.
    4 changes: 3 additions & 1 deletion ecr-pull-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,9 @@
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "ecr:GetAuthorizationToken",
    "Action": [
    "ecr:GetAuthorizationToken"
    ],
    "Resource": "*"
    },
    {
    4 changes: 3 additions & 1 deletion ecr-push-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,9 @@
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "ecr:GetAuthorizationToken",
    "Action": [
    "ecr:GetAuthorizationToken"
    ],
    "Resource": "*"
    },
    {
    4 changes: 3 additions & 1 deletion s3-bucket-public-read.json
    View file
    Original file line number Diff line number Diff line change
    @@ -4,7 +4,9 @@
    {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Action": [
    "s3:GetObject"
    ],
    "Resource": [
    "arn:aws:s3:::<your-bucket-name>/*"
    ]
  3. vaibhavpandeyvpz revised this gist Jan 7, 2022. 3 changed files with 9 additions and 3 deletions.
    4 changes: 3 additions & 1 deletion ecr-pull-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -13,7 +13,9 @@
    "ecr:BatchGetImage",
    "ecr:GetDownloadUrlForLayer"
    ],
    "Resource": "arn:aws:ecr:<your-region>:<your-account-id>:repository/<your-repository-name>"
    "Resource": [
    "arn:aws:ecr:<your-region>:<your-account-id>:repository/<your-repository-name>"
    ]
    }
    ]
    }
    4 changes: 3 additions & 1 deletion ecr-push-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -15,7 +15,9 @@
    "ecr:PutImage",
    "ecr:UploadLayerPart"
    ],
    "Resource": "arn:aws:ecr:<your-region>:<your-account-id>:repository/<your-repository-name>"
    "Resource": [
    "arn:aws:ecr:<your-region>:<your-account-id>:repository/<your-repository-name>"
    ]
    }
    ]
    }
    4 changes: 3 additions & 1 deletion iam-manage-own-credentials.json
    View file
    Original file line number Diff line number Diff line change
    @@ -11,7 +11,9 @@
    "iam:ListAccessKeys",
    "iam:UpdateAccessKey"
    ],
    "Resource": "arn:aws:iam:::user/${aws:username}"
    "Resource": [
    "arn:aws:iam:::user/${aws:username}"
    ]
    }
    ]
    }
  4. vaibhavpandeyvpz revised this gist Jan 7, 2022. 1 changed file with 4 additions and 0 deletions.
    4 changes: 4 additions & 0 deletions ecs-role-task-execution.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,4 @@
    Must include below policies:

    - [AmazonSSMManagedInstanceCore](https://console.aws.amazon.com/iam/home#/policies/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2FAmazonSSMManagedInstanceCore)
    - [AmazonECSTaskExecutionRolePolicy](https://console.aws.amazon.com/iam/home#/policies/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2Fservice-role%2FAmazonECSTaskExecutionRolePolicy)
  5. vaibhavpandeyvpz revised this gist Jan 7, 2022. 1 changed file with 15 additions and 0 deletions.
    15 changes: 15 additions & 0 deletions ecs-role-task.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,15 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "ssmmessages:CreateControlChannel",
    "ssmmessages:CreateDataChannel",
    "ssmmessages:OpenControlChannel",
    "ssmmessages:OpenDataChannel"
    ],
    "Resource": "*"
    }
    ]
    }
  6. vaibhavpandeyvpz revised this gist Jan 6, 2022. 1 changed file with 6 additions and 2 deletions.
    8 changes: 6 additions & 2 deletions ecs-update-service.json
    View file
    Original file line number Diff line number Diff line change
    @@ -3,12 +3,16 @@
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "ecs:ListTaskDefinitions",
    "Action": [
    "ecs:ListTaskDefinitions"
    ],
    "Resource": "*"
    },
    {
    "Effect": "Allow",
    "Action": "ecs:UpdateService",
    "Action": [
    "ecs:UpdateService"
    ],
    "Resource": "*",
    "Condition": {
    "ArnEquals": {
  7. vaibhavpandeyvpz revised this gist Jan 6, 2022. 1 changed file with 20 additions and 0 deletions.
    20 changes: 20 additions & 0 deletions ecs-update-service.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,20 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "ecs:ListTaskDefinitions",
    "Resource": "*"
    },
    {
    "Effect": "Allow",
    "Action": "ecs:UpdateService",
    "Resource": "*",
    "Condition": {
    "ArnEquals": {
    "ecs:cluster": "arn:aws:ecs:<your-region>:<your-account>:cluster/<your-service>"
    }
    }
    }
    ]
    }
  8. vaibhavpandeyvpz revised this gist Jan 6, 2022. 2 changed files with 20 additions and 2 deletions.
    19 changes: 19 additions & 0 deletions s3-bucket-read-write.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "s3:DeleteObject",
    "s3:GetObject",
    "s3:ListBucket",
    "s3:PutObject",
    "s3:PutObjectAcl"
    ],
    "Resource": [
    "arn:aws:s3:::<your-bucket-name>",
    "arn:aws:s3:::<your-bucket-name>/*"
    ]
    }
    ]
    }
    3 changes: 1 addition & 2 deletions s3-bucket-sync-via-cli.json
    View file
    Original file line number Diff line number Diff line change
    @@ -9,8 +9,7 @@
    "s3:GetObject",
    "s3:ListBucket",
    "s3:PutObject",
    "s3:PutObjectAcl",
    "s3:PutObjectV2"
    "s3:PutObjectAcl"
    ],
    "Resource": [
    "arn:aws:s3:::<your-bucket-name>",
  9. vaibhavpandeyvpz revised this gist Jan 5, 2022. 2 changed files with 19 additions and 0 deletions.
    19 changes: 19 additions & 0 deletions ecr-pull-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "ecr:GetAuthorizationToken",
    "Resource": "*"
    },
    {
    "Effect": "Allow",
    "Action": [
    "ecr:BatchCheckLayerAvailability",
    "ecr:BatchGetImage",
    "ecr:GetDownloadUrlForLayer"
    ],
    "Resource": "arn:aws:ecr:<your-region>:<your-account-id>:repository/<your-repository-name>"
    }
    ]
    }
    0 ecr-put-docker-image.json → ecr-push-docker-image.json
    View file
    File renamed without changes.
  10. vaibhavpandeyvpz revised this gist Jan 5, 2022. 2 changed files with 2 additions and 2 deletions.
    2 changes: 1 addition & 1 deletion cloudfront-invalidate.json
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@
    "cloudfront:CreateInvalidation"
    ],
    "Resource": [
    "arn:aws:cloudfront:::distribution/<your-distribution-id>"
    "arn:aws:cloudfront::<your-account-id>:distribution/<your-distribution-id>"
    ]
    }
    ]
    2 changes: 1 addition & 1 deletion ecr-put-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -15,7 +15,7 @@
    "ecr:PutImage",
    "ecr:UploadLayerPart"
    ],
    "Resource": "arn:aws:ecr:<your-region>::repository/<your-repository-name>"
    "Resource": "arn:aws:ecr:<your-region>:<your-account-id>:repository/<your-repository-name>"
    }
    ]
    }
  11. vaibhavpandeyvpz revised this gist Jan 5, 2022. 2 changed files with 5 additions and 5 deletions.
    2 changes: 1 addition & 1 deletion cloudfront-invalidate.json
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@
    "cloudfront:CreateInvalidation"
    ],
    "Resource": [
    "arn:aws:cloudfront:::distribution/<distribution_id>"
    "arn:aws:cloudfront:::distribution/<your-distribution-id>"
    ]
    }
    ]
    8 changes: 4 additions & 4 deletions ecr-put-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -9,13 +9,13 @@
    {
    "Effect": "Allow",
    "Action": [
    "ecr:BatchCheckLayerAvailability",
    "ecr:CompleteLayerUpload",
    "ecr:UploadLayerPart",
    "ecr:InitiateLayerUpload",
    "ecr:BatchCheckLayerAvailability",
    "ecr:PutImage"
    "ecr:PutImage",
    "ecr:UploadLayerPart"
    ],
    "Resource": "arn:aws:ecr:::repository/<your-repository-name>"
    "Resource": "arn:aws:ecr:<your-region>::repository/<your-repository-name>"
    }
    ]
    }
  12. vaibhavpandeyvpz revised this gist Jan 5, 2022. 3 changed files with 23 additions and 2 deletions.
    2 changes: 1 addition & 1 deletion cloudfront-invalidate.json
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@
    "cloudfront:CreateInvalidation"
    ],
    "Resource": [
    "arn:aws:cloudfront::<account_id>:distribution/<distribution_id>"
    "arn:aws:cloudfront:::distribution/<distribution_id>"
    ]
    }
    ]
    21 changes: 21 additions & 0 deletions ecr-put-docker-image.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,21 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "ecr:GetAuthorizationToken",
    "Resource": "*"
    },
    {
    "Effect": "Allow",
    "Action": [
    "ecr:CompleteLayerUpload",
    "ecr:UploadLayerPart",
    "ecr:InitiateLayerUpload",
    "ecr:BatchCheckLayerAvailability",
    "ecr:PutImage"
    ],
    "Resource": "arn:aws:ecr:::repository/<your-repository-name>"
    }
    ]
    }
    2 changes: 1 addition & 1 deletion iam-manage-own-credentials.json
    View file
    Original file line number Diff line number Diff line change
    @@ -11,7 +11,7 @@
    "iam:ListAccessKeys",
    "iam:UpdateAccessKey"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    "Resource": "arn:aws:iam:::user/${aws:username}"
    }
    ]
    }
  13. vaibhavpandeyvpz revised this gist Jan 5, 2022. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions 00-common-aws-policies.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    This Gist includes some of the common AWS/IAM policy examples to give granular access to users.
  14. vaibhavpandeyvpz revised this gist Jan 5, 2022. 1 changed file with 17 additions and 0 deletions.
    17 changes: 17 additions & 0 deletions iam-manage-own-credentials.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,17 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "iam:CreateAccessKey",
    "iam:DeleteAccessKey",
    "iam:GetAccessKeyLastUsed",
    "iam:GetUser",
    "iam:ListAccessKeys",
    "iam:UpdateAccessKey"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
    ]
    }
  15. vaibhavpandeyvpz revised this gist Jan 5, 2022. 2 changed files with 6 additions and 2 deletions.
    4 changes: 3 additions & 1 deletion cloudfront-invalidate.json
    View file
    Original file line number Diff line number Diff line change
    @@ -6,7 +6,9 @@
    "Action": [
    "cloudfront:CreateInvalidation"
    ],
    "Resource": "arn:aws:cloudfront::<account_id>:distribution/<distribution_id>"
    "Resource": [
    "arn:aws:cloudfront::<account_id>:distribution/<distribution_id>"
    ]
    }
    ]
    }
    4 changes: 3 additions & 1 deletion s3-bucket-public-read.json
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,9 @@
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::<your-bucket-name>/*"
    "Resource": [
    "arn:aws:s3:::<your-bucket-name>/*"
    ]
    }
    ]
    }
  16. vaibhavpandeyvpz revised this gist Jan 5, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion cloudfront-invalidate.json
    View file
    Original file line number Diff line number Diff line change
    @@ -6,7 +6,7 @@
    "Action": [
    "cloudfront:CreateInvalidation"
    ],
    "Resource": "*"
    "Resource": "arn:aws:cloudfront::<account_id>:distribution/<distribution_id>"
    }
    ]
    }
  17. vaibhavpandeyvpz revised this gist Jan 5, 2022. 3 changed files with 12 additions and 2 deletions.
    12 changes: 12 additions & 0 deletions cloudfront-invalidate.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,12 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "cloudfront:CreateInvalidation"
    ],
    "Resource": "*"
    }
    ]
    }
    1 change: 0 additions & 1 deletion s3-bucket-public-read.json
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,6 @@
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "AllowPublicReadAccess",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    1 change: 0 additions & 1 deletion s3-bucket-sync-via-cli.json
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,6 @@
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "AllowSyncViaCli",
    "Effect": "Allow",
    "Action": [
    "s3:DeleteObject",
  18. vaibhavpandeyvpz created this gist Jan 5, 2022.
    12 changes: 12 additions & 0 deletions s3-bucket-public-read.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,12 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "AllowPublicReadAccess",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::<your-bucket-name>/*"
    }
    ]
    }
    22 changes: 22 additions & 0 deletions s3-bucket-sync-via-cli.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,22 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "AllowSyncViaCli",
    "Effect": "Allow",
    "Action": [
    "s3:DeleteObject",
    "s3:GetBucketLocation",
    "s3:GetObject",
    "s3:ListBucket",
    "s3:PutObject",
    "s3:PutObjectAcl",
    "s3:PutObjectV2"
    ],
    "Resource": [
    "arn:aws:s3:::<your-bucket-name>",
    "arn:aws:s3:::<your-bucket-name>/*"
    ]
    }
    ]
    }