Adam Moussa
acdba9a4d4
GPT-4.1 IAM cross-review 2026-06-18: APPROVE, no BLOCKs. Applied FIXes: - trust policy: add aws:SourceAccount=328440206208 (confused-deputy guard) alongside the existing aws:SourceArn trust-anchor pin - readonly policy: remove ec2:DescribeImages (data minimization — AMIs are not an idle-spend signal) - aws:RequestedRegion NIT: deliberately SKIPPED — ce:* and s3:ListAllMyBuckets are global-endpoint services a blanket region condition could DENY; rationale recorded in aws-posture-readonly-policy.rationale.md - rationale.md + CROSS-REVIEW-PACKET.md: record APPROVE + FIXes + NIT answers (snapshots=account-owned idle signal; s3 list=names-only; no logs:* needed)
71 lines
1.8 KiB
JSON
71 lines
1.8 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "CostAndUsageReadOnly",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ce:GetCostAndUsage",
|
|
"ce:GetCostAndUsageWithResources",
|
|
"ce:GetCostForecast",
|
|
"ce:GetDimensionValues",
|
|
"ce:GetTags",
|
|
"ce:GetReservationUtilization",
|
|
"ce:GetSavingsPlansUtilization",
|
|
"ce:GetAnomalies",
|
|
"ce:GetAnomalyMonitors",
|
|
"ce:GetAnomalySubscriptions"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "CloudWatchMetricsReadOnly",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"cloudwatch:GetMetricData",
|
|
"cloudwatch:GetMetricStatistics",
|
|
"cloudwatch:ListMetrics",
|
|
"cloudwatch:DescribeAlarms",
|
|
"cloudwatch:DescribeAlarmsForMetric"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "Ec2DescribeReadOnly",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:DescribeInstances",
|
|
"ec2:DescribeInstanceStatus",
|
|
"ec2:DescribeVolumes",
|
|
"ec2:DescribeAddresses",
|
|
"ec2:DescribeNatGateways",
|
|
"ec2:DescribeSnapshots",
|
|
"ec2:DescribeRegions"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "ElbAndRdsDescribeReadOnly",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:DescribeLoadBalancers",
|
|
"elasticloadbalancing:DescribeTargetGroups",
|
|
"elasticloadbalancing:DescribeTargetHealth",
|
|
"rds:DescribeDBInstances",
|
|
"rds:DescribeDBClusters"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "LambdaAndStorageInventoryReadOnly",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"lambda:ListFunctions",
|
|
"lambda:GetFunctionConfiguration",
|
|
"s3:ListAllMyBuckets",
|
|
"s3:GetBucketLocation"
|
|
],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|