-
Notifications
You must be signed in to change notification settings - Fork 131
/
prerequisites.yaml
85 lines (85 loc) · 3.25 KB
/
prerequisites.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
AWSTemplateFormatVersion: "2010-09-09"
Description: >
Creates the prerequisites for the AWS Service Broker -
https://github.com/awslabs/aws-servicebroker/blob/master/docs/install_prereqs.md
Resources:
BrokerTable:
Type: "AWS::DynamoDB::Table"
Properties:
AttributeDefinitions:
- AttributeName: id
AttributeType: S
- AttributeName: userid
AttributeType: S
- AttributeName: type
AttributeType: S
KeySchema:
- AttributeName: id
KeyType: HASH
- AttributeName: userid
KeyType: RANGE
ProvisionedThroughput:
ReadCapacityUnits: 5
WriteCapacityUnits: 5
TableName: "awssb"
GlobalSecondaryIndexes:
- IndexName: "type-userid-index"
KeySchema:
- AttributeName: type
KeyType: HASH
- AttributeName: userid
KeyType: RANGE
Projection:
ProjectionType: INCLUDE
NonKeyAttributes: [ id, userid, type, locked ]
ProvisionedThroughput:
ReadCapacityUnits: 5
WriteCapacityUnits: 5
BrokerUser:
Type: "AWS::IAM::User"
Properties:
Policies:
- PolicyName: AwsServiceBrokerPolicy
PolicyDocument:
Version: "2012-10-17"
Statement:
- Action: [ "s3:GetObject", "s3:ListBucket" ]
Resource: [ "arn:aws:s3:::awsservicebroker/templates/*", "arn:aws:s3:::awsservicebroker" ]
Effect: "Allow"
- Action: [ "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem" ]
Resource: !Sub "arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${BrokerTable}"
Effect: "Allow"
- Action: [ "ssm:GetParameter", "ssm:GetParameters" ]
Resource:
- !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/asb-*"
- !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/Asb*"
Effect: "Allow"
- PolicyName: AwsServiceBrokerProvisioningPolicy
PolicyDocument:
Version: "2012-10-17"
Statement:
- Action: [ "ssm:PutParameter", "ssm:GetParameter", "ssm:GetParameters" ]
Resource:
- !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/asb-*"
- !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/Asb*"
Effect: "Allow"
- Action: "s3:GetObject"
Resource: "arn:aws:s3:::awsservicebroker/templates/*"
Effect: "Allow"
- Action:
- "cloudformation:CreateStack"
- "cloudformation:DeleteStack"
- "cloudformation:DescribeStacks"
- "cloudformation:DescribeStackEvents"
- "cloudformation:UpdateStack"
- "cloudformation:CancelUpdateStack"
Resource: !Sub "arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/aws-service-broker-*/*"
Effect: "Allow"
- Action: [ "athena:*", "dynamodb:*", "kms:*", "elasticache:*", "elasticmapreduce:*", "kinesis:*", "rds:*",
"redshift:*", "route53:*", "s3:*", "sns:*", "sns:*", "sqs:*", "ec2:*", "iam:*", "lambda:*" ,
"codecommit:*"]
Resource: "*"
Effect: "Allow"
Outputs:
IAMUser:
Value: !Ref BrokerUser