[英]Create a CloudFormation only AWS policy
I want to create a policy and role in AWS that will allow creating resources only through CloudFormation and not through console. 我想在AWS中创建一个策略和角色,该策略和角色仅允许通过CloudFormation而不是通过控制台创建资源。 What is the best possible way to achieve this?
实现此目标的最佳方法是什么?
The easiest way to achieve what you're looking to do would be to create a CloudFormation Service role, and grant your users the ability to pass this role to CloudFormation, and perform CloudFormation Creates, Updates, etc. 实现您要执行的操作的最简单方法是创建一个CloudFormation服务角色,并向您的用户授予将该角色传递给CloudFormation并执行CloudFormation创建,更新等功能。
I've created a CloudFormation template with starting point roles and groups with policies that should do what you're looking for. 我创建了一个CloudFormation模板,该模板具有起点角色和具有应执行您要查找的策略的组。
CloudFormationServiceRole
: The actual role used by CloudFormation with permissions to perform actions in AWS CloudFormationServiceRole
:CloudFormation有权在AWS中执行操作的实际角色 UsersGroup
: The Group to add yours users to. UsersGroup
:要将您的用户添加到的组。 It has permission to perform actions in CloudFormation and pass the CloudFormationServiceRole
, and nothing else. CloudFormationServiceRole
权限,仅此而已。 AWSTemplateFormatVersion: 2010-09-09
Resources:
CloudFormationServiceRole:
# This Role will actually do all of the heavy lifting and resouce
# creation
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
-
Effect: Allow
Principal:
Service:
- cloudformation.amazonaws.com
Action:
- sts:AssumeRole
Policies:
-
PolicyName: CloudformationAccess
PolicyDocument:
# This policy defines what the users can actually do
# With Cloudformation
Version: 2012-10-17
Statement:
-
Effect: Allow
Action: "*"
Resource: "*"
UsersGroup:
# The users will use the role, but do nothing themselves
Type: AWS::IAM::Group
Properties:
Policies:
-
PolicyName: UsersCloudformationAccess
PolicyDocument:
Version: 2012-10-17
Statement:
-
Effect: Allow
Action:
- cloudformation:*
Resource: "*"
-
Effect: Allow
Action:
- iam:GetRole
- iam:PassRole
Resource: !GetAtt CloudFormationServiceRole.Arn
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.