[英]Create a CloudFormation only AWS policy
我想在AWS中创建一个策略和角色,该策略和角色仅允许通过CloudFormation而不是通过控制台创建资源。 实现此目标的最佳方法是什么?
实现您要执行的操作的最简单方法是创建一个CloudFormation服务角色,并向您的用户授予将该角色传递给CloudFormation并执行CloudFormation创建,更新等功能。
我创建了一个CloudFormation模板,该模板具有起点角色和具有应执行您要查找的策略的组。
CloudFormationServiceRole
:CloudFormation有权在AWS中执行操作的实际角色 UsersGroup
:要将您的用户添加到的组。 它具有在CloudFormation中执行操作并传递CloudFormationServiceRole
权限,仅此而已。 AWSTemplateFormatVersion: 2010-09-09
Resources:
CloudFormationServiceRole:
# This Role will actually do all of the heavy lifting and resouce
# creation
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
-
Effect: Allow
Principal:
Service:
- cloudformation.amazonaws.com
Action:
- sts:AssumeRole
Policies:
-
PolicyName: CloudformationAccess
PolicyDocument:
# This policy defines what the users can actually do
# With Cloudformation
Version: 2012-10-17
Statement:
-
Effect: Allow
Action: "*"
Resource: "*"
UsersGroup:
# The users will use the role, but do nothing themselves
Type: AWS::IAM::Group
Properties:
Policies:
-
PolicyName: UsersCloudformationAccess
PolicyDocument:
Version: 2012-10-17
Statement:
-
Effect: Allow
Action:
- cloudformation:*
Resource: "*"
-
Effect: Allow
Action:
- iam:GetRole
- iam:PassRole
Resource: !GetAtt CloudFormationServiceRole.Arn
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.