-
Notifications
You must be signed in to change notification settings - Fork 2
/
blog-prerequisites.yml
84 lines (81 loc) · 2.44 KB
/
blog-prerequisites.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
---
AWSTemplateFormatVersion: "2010-09-09"
Description: >
###################################################################################
#
# **WARNING**
# This template creates IAM Role, IAM Policy, EBS Volume and related resources.
# You will be billed for the AWS resources used if you create a stack from this template.
#
###################################################################################
Resources:
SSMEBSOperationsAutomationsExecutionRole:
Type: "AWS::IAM::Role"
Properties:
RoleName: SSMAutomationChangeManagerEBS
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Principal:
Service:
- "ssm.amazonaws.com"
Action:
- "sts:AssumeRole"
Path: "/"
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonSSMAutomationRole
SSMEBSOperationsAutomationExecutionRolePolicies:
Type: "AWS::IAM::Policy"
Properties:
PolicyName: "ChangManagerEBSVolume"
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Action: [
"ec2:DeleteVolume",
"iam:PassRole",
"ec2:DescribeVolumeStatus",
"ec2:DeleteSnapshot",
"ec2:CreateSnapshots",
"ec2:DescribeVolumes",
"ec2:CreateSnapshot",
"ssm:StartChangeRequestExecution",
"iam:PassRole",
"ec2:DescribeSnapshots"
]
Resource: "*"
Roles:
-
Ref: "SSMEBSOperationsAutomationsExecutionRole"
SSMConfigEC2LabRole:
Type: AWS::IAM::Role
Properties:
RoleName: WorkshopEC2SSMRole
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: ec2.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
SSMConfigEC2LabProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Roles:
- !Ref "SSMConfigEC2LabRole"
Path: /
InstanceProfileName: WorkshopEC2SSMRole
UnusedEBSVolume:
Type: AWS::EC2::Volume
Properties:
Size: 10
VolumeType: gp3
AvailabilityZone: !Select
- 0
- Fn::GetAZs: !Ref "AWS::Region"