-
Notifications
You must be signed in to change notification settings - Fork 12
/
iam_policy_chapter_13.json
240 lines (240 loc) · 9.47 KB
/
iam_policy_chapter_13.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"glue:BatchCreatePartition",
"glue:DeleteDatabase",
"glue:GetPartitions",
"s3:ListBucketVersions",
"glue:UpdateTable",
"s3:CreateBucket",
"glue:DeleteTable",
"s3:ListBucket",
"athena:GetDataCatalog",
"athena:UpdateWorkGroup",
"athena:GetWorkGroup",
"iam:PassRole",
"s3:AbortMultipartUpload",
"glue:CreatePartition",
"s3:DeleteObject",
"glue:UpdatePartition",
"s3:ListBucketMultipartUploads",
"glue:UpdateDatabase",
"glue:CreateTable",
"glue:GetTables",
"athena:DeleteWorkGroup",
"glue:BatchGetPartition",
"glue:GetDatabases",
"athena:CreateWorkGroup",
"s3:ListMultipartUploadParts",
"glue:GetTable",
"glue:GetDatabase",
"s3:PutObject",
"s3:GetObject",
"glue:GetPartition",
"lambda:AddPermission",
"glue:CreateDatabase",
"lambda:RemovePermission",
"glue:DeletePartition"
],
"Resource": [
"arn:aws:s3:::YOUR_S3_BUCKET/*",
"arn:aws:s3:::YOUR_S3_BUCKET",
"arn:aws:athena:*:YOUR_ACCOUNT_ID:datacatalog/*",
"arn:aws:athena:*:YOUR_ACCOUNT_ID:datacatalog/lambda:packt_serverless_analytics_*",
"arn:aws:athena:*:*:workgroup/primary",
"arn:aws:athena:*:*:workgroup/packt-*",
"arn:aws:iam::*:role/packt-serverless-analytics-*",
"arn:aws:lambda:*:YOUR_ACCOUNT_ID:function:packt_serverless_analytics*",
"arn:aws:glue:*:*:table/*/*",
"arn:aws:glue:*:*:database/packt_serverless_analytics",
"arn:aws:glue:*:*:catalog"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"athena:StartQueryExecution",
"athena:GetQueryResults",
"iam:CreateRole",
"iam:AttachRolePolicy",
"lambda:GetFunctionConfiguration",
"iam:PutRolePolicy",
"athena:GetNamedQuery",
"lambda:ListProvisionedConcurrencyConfigs",
"iam:DetachRolePolicy",
"iam:ListAttachedRolePolicies",
"athena:StopQueryExecution",
"lambda:DeleteFunction",
"iam:ListRolePolicies",
"lambda:GetAlias",
"s3:GetBucketPolicyStatus",
"iam:GetRole",
"lambda:UpdateFunctionEventInvokeConfig",
"athena:GetQueryResultsStream",
"iam:GetPolicy",
"lambda:GetEventSourceMapping",
"lambda:InvokeFunction",
"lambda:ListAliases",
"iam:DeleteRole",
"s3:GetBucketNotification",
"s3:DeleteBucketPolicy",
"athena:ListNamedQueries",
"lambda:UpdateAlias",
"s3:PutBucketNotification",
"lambda:UpdateFunctionCode",
"athena:CreateNamedQuery",
"lambda:ListFunctionEventInvokeConfigs",
"lambda:GetFunctionConcurrency",
"lambda:PublishVersion",
"athena:BatchGetNamedQuery",
"lambda:DeleteEventSourceMapping",
"iam:GetRolePolicy",
"athena:BatchGetQueryExecution",
"lambda:CreateAlias",
"lambda:ListVersionsByFunction",
"lambda:InvokeAsync",
"athena:DeleteNamedQuery",
"s3:GetBucketPolicy",
"athena:ListQueryExecutions",
"lambda:PutFunctionConcurrency",
"iam:PassRole",
"lambda:ListTags",
"iam:DeleteRolePolicy",
"lambda:PutFunctionEventInvokeConfig",
"lambda:DeleteFunctionEventInvokeConfig",
"lambda:UpdateEventSourceMapping",
"lambda:GetFunction",
"lambda:UpdateFunctionConfiguration",
"iam:CreateServiceLinkedRole",
"lambda:GetFunctionEventInvokeConfig",
"athena:GetQueryExecution",
"s3:PutBucketPolicy",
"lambda:DeleteAlias",
"iam:UpdateRole",
"lambda:DeleteFunctionConcurrency",
"lambda:GetPolicy"
],
"Resource": [
"arn:aws:athena:*:*:workgroup/primary",
"arn:aws:athena:*:*:workgroup/packt-*",
"arn:aws:athena:*:YOUR_ACCOUNT_ID:datacatalog/*",
"arn:aws:s3:::YOUR_S3_BUCKET",
"arn:aws:iam::YOUR_ACCOUNT_ID:policy/*",
"arn:aws:iam::*:role/*",
"arn:aws:lambda:*:YOUR_ACCOUNT_ID:event-source-mapping:*",
"arn:aws:lambda:*:YOUR_ACCOUNT_ID:function:packt_serverless_analytics*"
]
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"cloudformation:CreateUploadBucket",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:ListExports",
"lambda:GetAccountSettings",
"athena:ListWorkGroups",
"lambda:CreateEventSourceMapping",
"cloudformation:EstimateTemplateCost",
"athena:GetExecutionEngine",
"athena:GetExecutionEngines",
"cloudformation:DescribeAccountLimits",
"cloud9:UpdateUserSettings",
"cloudformation:CreateStackSet",
"athena:ListEngineVersions",
"cloudformation:ListStacks",
"cloud9:CreateEnvironmentEC2",
"cloudformation:ListImports",
"lambda:ListFunctions",
"s3:ListJobs",
"cloud9:GetUserSettings",
"athena:GetNamespace",
"iam:ListRoles",
"athena:GetCatalogs",
"athena:ListTagsForResource",
"ec2:DescribeSecurityGroups",
"cloud9:ListEnvironments",
"athena:GetNamespaces",
"s3:ListAllMyBuckets",
"cloudwatch:*",
"ec2:DescribeVpcs",
"kms:ListAliases",
"lambda:ListEventSourceMappings",
"athena:GetTables",
"athena:GetTable",
"ec2:DescribeSubnets",
"cloudformation:ValidateTemplate"
],
"Resource": "*"
},
{
"Sid": "VisualEditor3",
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"lambda:InvokeFunction",
"lambda:ListVersionsByFunction",
"lambda:GetFunction",
"lambda:ListAliases",
"lambda:UpdateFunctionConfiguration",
"lambda:GetFunctionConfiguration",
"lambda:PutFunctionConcurrency",
"lambda:UpdateFunctionCode",
"lambda:AddPermission",
"lambda:ListTags",
"lambda:DeleteFunction",
"lambda:DeleteFunctionConcurrency",
"lambda:GetAlias",
"s3:GetBucketLocation",
"lambda:RemovePermission",
"lambda:GetPolicy"
],
"Resource": [
"arn:aws:s3:::*",
"arn:aws:lambda:*:YOUR_ACCOUNT_ID:function:packt_serverless_analytics*"
]
},
{
"Sid": "VisualEditor4",
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::awsserverlessrepo-changesets-*"
},
{
"Sid": "VisualEditor5",
"Effect": "Allow",
"Action": "cloud9:*",
"Resource": "arn:aws:cloud9:*:YOUR_ACCOUNT_ID:environment:*"
},
{
"Sid": "VisualEditor6",
"Effect": "Allow",
"Action": "logs:*",
"Resource": "arn:aws:logs:*:*:*"
},
{
"Sid": "VisualEditor7",
"Effect": "Allow",
"Action": "cloudformation:*",
"Resource": [
"arn:aws:cloudformation:*:*:transform/Serverless-*",
"arn:aws:cloudformation:*:YOUR_ACCOUNT_ID:stackset/aws-serverless-repository-packt-serverless-analytics*:*",
"arn:aws:cloudformation:*:YOUR_ACCOUNT_ID:stackset/serverlessrepo-packt-serverless-analytics*:*",
"arn:aws:cloudformation:*:YOUR_ACCOUNT_ID:stack/aws-serverless-repository-packt-serverless-analytics*/*",
"arn:aws:cloudformation:*:YOUR_ACCOUNT_ID:stack/serverlessrepo-packt-serverless-analytics*/*"
]
},
{
"Sid": "VisualEditor8",
"Effect": "Allow",
"Action": "serverlessrepo:*",
"Resource": "arn:aws:serverlessrepo:*:*:applications/*"
}
]
}