{"id":1864,"date":"2017-01-25T16:31:39","date_gmt":"2017-01-25T21:31:39","guid":{"rendered":"http:\/\/blog.domb.net\/?p=1864"},"modified":"2017-05-18T11:39:24","modified_gmt":"2017-05-18T15:39:24","slug":"cloudforms-4-2-aws-minimal-iam-policies","status":"publish","type":"post","link":"https:\/\/blog.domb.net\/?p=1864","title":{"rendered":"CloudForms AWS  IAM policies"},"content":{"rendered":"<p>To enable Cloudforms to connect to the AWS provider you need to following policies:<\/p>\n<ul>\n<li>AmazonEC2FullAccess<\/li>\n<li>AWSConfigUserAccess<\/li>\n<li>IAMReadOnlyAccess<\/li>\n<li>IAMUserSSHKeys<\/li>\n<li>AWSCloudFormationReadOnlyAccess<\/li>\n<\/ul>\n<p>As well as two custom policies<\/p>\n<p>CFMESNS<\/p>\n<pre class=\"lang:js decode:true \">{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"sns:*\"\r\n            ],\r\n            \"Resource\": \"arn:aws:sns:us-east-1:${AWS-ACCT_ID}:AWSConfig_topic\"\r\n        }\r\n    ]\r\n}<\/pre>\n<p>CFMESQS<\/p>\n<pre class=\"lang:js decode:true \">{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"sqs:*\"\r\n            ],\r\n            \"Resource\": \"arn:aws:sqs:us-east-1:${AWS-ACCT_ID}:manageiq-awsconfig-queue*\"\r\n        }\r\n    ]\r\n}<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>To enable Cloudforms to connect to the AWS provider you need to following policies: AmazonEC2FullAccess AWSConfigUserAccess IAMReadOnlyAccess IAMUserSSHKeys AWSCloudFormationReadOnlyAccess As well as two custom policies CFMESNS { &#8220;Version&#8221;: &#8220;2012-10-17&#8221;, &#8220;Statement&#8221;: [ { &#8220;Effect&#8221;: &#8220;Allow&#8221;, &#8220;Action&#8221;: [ &#8220;sns:*&#8221; ], &#8220;Resource&#8221;: &#8220;arn:aws:sns:us-east-1:${AWS-ACCT_ID}:AWSConfig_topic&#8221; } ] } CFMESQS { &#8220;Version&#8221;: &#8220;2012-10-17&#8221;, &#8220;Statement&#8221;: [ { &#8220;Effect&#8221;: &#8220;Allow&#8221;, &#8220;Action&#8221;: [ &#8220;sqs:*&#8221;&#8230;<\/p>\n","protected":false},"author":2,"featured_media":2031,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[37],"tags":[108,29,109],"class_list":["post-1864","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloudforms","tag-aws","tag-cloudforms","tag-iam"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/1864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1864"}],"version-history":[{"count":7,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/1864\/revisions"}],"predecessor-version":[{"id":2032,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/1864\/revisions\/2032"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/media\/2031"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}