Scoped down IAM policy for building AMIs

[rajivr]

I just managed to build and launch an aws-dev AMI, by doing

$ cargo make -e BUILDSYS_VARIANT=aws-dev ami

However, in order to make pubsys happy, I attached AWS managed PowerUserAccess policy to the EC2 instance role.

Is there a scoped down IAM policy available somewhere with just the actions needed for pubsys?

[vigh-m]

Hi @rajivr , Thanks for reaching out. Just trying to understand the ask here, are you looking for a minimal IAM Policy which would allow you to publish and register a Bottlerocket AMI in your AWS Account?

If so, I was able to do this with a policy like below:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ebs:StartSnapshot",
                "ebs:CompleteSnapshot",
                "ebs:PutSnapshotBlock",
                "ec2:CreateSnapshot",
                "ec2:RegisterImage",
                "ec2:DescribeImages",
                "ec2:DescribeImageAttribute",
                "ec2:DescribeSnapshotAttribute",
                "ec2:DescribeSnapshots"
            ],
            "Resource": "*"
        }
    ]
}

The command I used to test this was cargo make -e BUILDSYS_VARIANT=aws-dev -e PUBLISH_REGIONS=<region> ami

[rajivr]

Thanks @vigh-m for the reply, and apologies for the delay in responding from my side.

I tested the above policy, and it works as expected.