-
Notifications
You must be signed in to change notification settings - Fork 0
/
awsimagebuilderrole
163 lines (163 loc) · 6.38 KB
/
awsimagebuilderrole
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/*imagebuilder*",
"Condition": {
"StringEquals": {
"iam:PassedToService": "ec2.amazonaws.com"
}
}
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder",
"Condition": {
"StringLike": {
"iam:AWSServiceName": "imagebuilder.amazonaws.com"
}
}
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": "iam:GetInstanceProfile",
"Resource": "arn:aws:iam::*:instance-profile/*imagebuilder*"
},
{
"Sid": "VisualEditor3",
"Effect": "Allow",
"Action": [
"s3:GetAccessPoint",
"license-manager:ListLicenseConfigurations",
"imagebuilder:*",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeRegions",
"s3:PutStorageLensConfiguration",
"iam:ListRoles",
"sns:ListTopics",
"iam:ListInstanceProfiles",
"ec2:DescribeSnapshots",
"ec2:DescribeSecurityGroups",
"license-manager:ListLicenseSpecificationsForResource",
"ec2:DescribeImages",
"s3:GetAccountPublicAccessBlock",
"ec2:DescribeInstanceTypeOfferings",
"s3:ListAllMyBuckets",
"ec2:DescribeVpcs",
"ec2:DescribeVolumes",
"s3:CreateJob",
"ec2:DescribeSubnets",
"ec2:DescribeKeyPairs",
"s3:GetBucketLocation"
],
"Resource": "*"
},
{
"Sid": "VisualEditor4",
"Effect": "Allow",
"Action": [
"s3:PutAnalyticsConfiguration",
"s3:GetObjectVersionTagging",
"s3:PutAccessPointConfigurationForObjectLambda",
"s3:DeleteAccessPoint",
"s3:CreateBucket",
"s3:DeleteAccessPointForObjectLambda",
"s3:GetStorageLensConfigurationTagging",
"s3:ReplicateObject",
"s3:GetBucketObjectLockConfiguration",
"s3:GetObjectAcl",
"s3:DeleteBucketWebsite",
"s3:GetIntelligentTieringConfiguration",
"s3:PutLifecycleConfiguration",
"s3:GetObjectVersionAcl",
"s3:DeleteObject",
"s3:CreateMultiRegionAccessPoint",
"s3:GetBucketPolicyStatus",
"iam:GetRole",
"s3:GetObjectRetention",
"s3:GetBucketWebsite",
"s3:GetJobTagging",
"s3:GetMultiRegionAccessPoint",
"s3:PutReplicationConfiguration",
"s3:PutObjectLegalHold",
"s3:GetBucketNotification",
"s3:GetObjectLegalHold",
"s3:PutBucketCORS",
"s3:DescribeMultiRegionAccessPointOperation",
"s3:GetReplicationConfiguration",
"s3:GetObject",
"s3:PutBucketNotification",
"s3:PutObject",
"s3:DescribeJob",
"s3:PutBucketLogging",
"s3:GetAnalyticsConfiguration",
"s3:GetObjectVersionForReplication",
"s3:PutBucketObjectLockConfiguration",
"s3:GetAccessPointForObjectLambda",
"s3:GetStorageLensDashboard",
"s3:CreateAccessPoint",
"s3:GetLifecycleConfiguration",
"s3:GetBucketTagging",
"s3:GetInventoryConfiguration",
"s3:PutAccelerateConfiguration",
"s3:DeleteObjectVersion",
"s3:GetAccessPointPolicyForObjectLambda",
"s3:GetBucketLogging",
"s3:RestoreObject",
"s3:GetAccelerateConfiguration",
"s3:ListBucket",
"s3:GetBucketPolicy",
"s3:PutEncryptionConfiguration",
"s3:GetEncryptionConfiguration",
"s3:GetObjectVersionTorrent",
"sns:Publish",
"s3:AbortMultipartUpload",
"s3:GetBucketRequestPayment",
"s3:GetAccessPointPolicyStatus",
"s3:UpdateJobPriority",
"s3:GetObjectTagging",
"s3:GetBucketOwnershipControls",
"s3:GetMetricsConfiguration",
"s3:DeleteBucket",
"s3:PutBucketVersioning",
"s3:GetBucketPublicAccessBlock",
"s3:GetMultiRegionAccessPointPolicyStatus",
"s3:GetMultiRegionAccessPointPolicy",
"s3:PutIntelligentTieringConfiguration",
"s3:GetAccessPointPolicyStatusForObjectLambda",
"s3:PutMetricsConfiguration",
"s3:PutBucketOwnershipControls",
"s3:DeleteMultiRegionAccessPoint",
"s3:GetBucketVersioning",
"s3:UpdateJobStatus",
"s3:GetAccessPointConfigurationForObjectLambda",
"s3:GetBucketAcl",
"s3:PutInventoryConfiguration",
"s3:GetObjectTorrent",
"s3:GetStorageLensConfiguration",
"s3:DeleteStorageLensConfiguration",
"s3:PutBucketRequestPayment",
"s3:PutBucketWebsite",
"s3:PutObjectRetention",
"s3:CreateAccessPointForObjectLambda",
"s3:GetBucketCORS",
"s3:GetAccessPointPolicy",
"s3:GetBucketLocation",
"s3:GetObjectVersion",
"s3:ReplicateDelete"
],
"Resource": [
"arn:aws:sns:*:*:*imagebuilder*",
"arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder",
"arn:aws:s3::*:*",
"arn:aws:s3:::"*"
]
}
]
}