-
Notifications
You must be signed in to change notification settings - Fork 5
/
cf-iam.yaml
64 lines (64 loc) · 2.54 KB
/
cf-iam.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# * SPDX-License-Identifier: MIT-0
# *
# * Permission is hereby granted, free of charge, to any person obtaining a copy of this
# * software and associated documentation files (the "Software"), to deal in the Software
# * without restriction, including without limitation the rights to use, copy, modify,
# * merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# * permit persons to whom the Software is furnished to do so.
# *
# * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# * INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
# *
---
AWSTemplateFormatVersion: 2010-09-09
Description: This CloudFormation template creates IAM role which can be assumed by the SSM runbook with the permission to tag resources
Resources:
TagRemediationAutomationRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ssm.amazonaws.com
Action:
- 'sts:AssumeRole'
Description: role for tag remediation automation
RoleName: TagRemediationAutomationRole
TagRemediationAutomationPolicy:
Type: 'AWS::IAM::Policy'
Properties:
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- 'config:GetComplianceDetailsByConfigRule'
- 'config:DescribeConformancePacks'
- 'config:BatchGetResourceConfig'
- 'tag:getResources'
- 'tag:getTagKeys'
- 'tag:getTagValues'
- 'tag:TagResources'
Resource: '*'
- Effect: Allow
Action:
- 'ec2:CreateTags'
Resource: !Sub 'arn:${AWS::Partition}:ec2:*:*:instance/*'
PolicyName: TagRemediationAutomationPolicy
Roles:
- !Ref TagRemediationAutomationRole
Outputs:
RoleName:
Description: Name of Created IAM Role
Value: !Ref TagRemediationAutomationRole
RoleArn:
Description: Arn of Created Role
Value: !GetAtt TagRemediationAutomationRole.Arn