shorty/sample-iam-user-policy.json at main · aulvi/shorty · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "CloudFormationPermissions",
			"Effect": "Allow",
			"Action": [
				"cloudformation:*",
				"cloudformation:UpdateStack",
				"cloudformation:DeleteStack",
				"cloudformation:DescribeStacks",
				"cloudformation:DescribeStackResources",
				"cloudformation:GetTemplate",
				"cloudformation:ListStackResources",
				"cloudformation:CreateChangeSet",
				"cloudformation:DescribeChangeSet",
				"cloudformation:ExecuteChangeSet",
				"cloudformation:DeleteChangeSet",
				"cloudformation:ListChangeSets",
				"cloudformation:DescribeStackEvents",
				"cloudformation:GetTemplateSummary"
			],
			"Resource": [
				"arn:aws:cloudformation:*:<AWS_ACCOUNT_ID>:stack/*",
				"arn:aws:cloudformation:*:*:transform/Serverless-2016-10-31"
			]
		},
		{
			"Sid": "S3Permissions",
			"Effect": "Allow",
			"Action": [
				"s3:CreateBucket",
				"s3:DeleteBucket",
				"s3:PutObject",
				"s3:GetObject",
				"s3:DeleteObject",
				"s3:ListBucket",
				"s3:GetBucketWebsite",
				"s3:PutBucketWebsite",
				"s3:DeleteBucketWebsite",
				"s3:GetAccountPublicAccessBlock",
				"s3:GetBucketPublicAccessBlock",
				"s3:PutAccessPointPublicAccessBlock",
				"s3:PutAccountPublicAccessBlock",
				"s3:PutBucketPublicAccessBlock",
				"s3:GetBucketPolicy",
				"s3:PutBucketPolicy",
				"s3:DeleteBucketPolicy",
				"s3:GetBucketPolicyStatus"
			],
			"Resource": [
				"arn:aws:s3:::shorty-*",
				"arn:aws:s3:::shorty-*/*",
				"arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*/shorty/*",
				"arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-*"
			]
		},
		{
			"Sid": "DynamoDBPermissions",
			"Effect": "Allow",
			"Action": [
				"dynamodb:CreateTable",
				"dynamodb:DeleteTable",
				"dynamodb:DescribeTable",
				"dynamodb:UpdateTable",
				"dynamodb:PutItem",
				"dynamodb:GetItem",
				"dynamodb:Query",
				"dynamodb:Scan"
			],
			"Resource": "arn:aws:dynamodb:*:<AWS_ACCOUNT_ID>:table/shorty-*"
		},
		{
			"Sid": "LambdaPermissions",
			"Effect": "Allow",
			"Action": [
				"lambda:CreateFunction",
				"lambda:DeleteFunction",
				"lambda:GetFunction",
				"lambda:UpdateFunctionCode",
				"lambda:UpdateFunctionConfiguration",
				"lambda:InvokeFunction",
				"lambda:ListFunctions",
				"lambda:TagResource",
				"lambda:AddPermission",
				"lambda:RemovePermission",
				"lambda:ListTags"
			],
			"Resource": "arn:aws:lambda:*:<AWS_ACCOUNT_ID>:function:shorty-*"
		},
		{
			"Sid": "IAMPermissions",
			"Effect": "Allow",
			"Action": [
				"iam:CreateRole",
				"iam:AttachRolePolicy",
				"iam:DetachRolePolicy",
				"iam:DeleteRolePolicy",
				"iam:DeleteRole",
				"iam:GetRole",
				"iam:PassRole",
				"iam:TagRole",
				"iam:UntagRole",
				"iam:PutRolePolicy"
			],
			"Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/shorty-*"
		},
		{
			"Sid": "TaggingPermissions",
			"Effect": "Allow",
			"Action": [
				"tag:GetResources",
				"tag:TagResources",
				"tag:UntagResources"
			],
			"Resource": "*"
		},
		{
			"Sid": "AllowApiGatewayActions",
			"Effect": "Allow",
			"Action": [
				"apigateway:*"
			],
			"Resource": "*"
		},
		{
			"Sid": "AllowCognitoUserPoolManagement",
			"Effect": "Allow",
			"Action": [
				"cognito-idp:CreateUserPool",
				"cognito-idp:CreateUserPoolClient",
				"cognito-idp:DeleteUserPool",
				"cognito-idp:DeleteUserPoolClient",
				"cognito-idp:UpdateUserPool",
				"cognito-idp:UpdateUserPoolClient",
				"cognito-idp:DescribeUserPool",
				"cognito-idp:DescribeUserPoolClient"
			],
			"Resource": "arn:aws:cognito-idp:*:*:userpool/*"
		}
	]
}