mirror of
https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git
synced 2026-09-30 05:43:17 +00:00
7e41625e4b
A first apply of Fargate and Scheduler targets cannot create those service-linked attachments while PassRole is Lambda-only.
141 lines
4 KiB
Cheetah
141 lines
4 KiB
Cheetah
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "DenyCreatePolicy",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"iam:CreatePolicy",
|
|
"iam:CreatePolicyVersion"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "CreateExecRoleWithBoundary",
|
|
"Effect": "Allow",
|
|
"Action": "iam:CreateRole",
|
|
"Resource": "arn:aws:iam::__ACCOUNT_ID__:role/tf-managed/__STACK_PREFIX__*",
|
|
"Condition": {
|
|
"StringLike": {
|
|
"iam:PermissionsBoundary": [
|
|
"arn:aws:iam::__ACCOUNT_ID__:policy/tf-managed/__STACK_PREFIX__*",
|
|
"arn:aws:iam::__ACCOUNT_ID__:policy/seahaven-lambda-execution-boundary",
|
|
"arn:aws:iam::__ACCOUNT_ID__:policy/seahaven-lambda-execution-boundary-__STACK_NAME__"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "MutateExecRoleWithBoundary",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:AttachRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:PutRolePermissionsBoundary"
|
|
],
|
|
"Resource": "arn:aws:iam::__ACCOUNT_ID__:role/tf-managed/__STACK_PREFIX__*",
|
|
"Condition": {
|
|
"StringLike": {
|
|
"iam:PermissionsBoundary": [
|
|
"arn:aws:iam::__ACCOUNT_ID__:policy/tf-managed/__STACK_PREFIX__*",
|
|
"arn:aws:iam::__ACCOUNT_ID__:policy/seahaven-lambda-execution-boundary",
|
|
"arn:aws:iam::__ACCOUNT_ID__:policy/seahaven-lambda-execution-boundary-__STACK_NAME__"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "WriteExecRoles",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:DeleteRole",
|
|
"iam:DeleteRolePolicy",
|
|
"iam:DetachRolePolicy",
|
|
"iam:TagRole",
|
|
"iam:UntagRole",
|
|
"iam:UpdateAssumeRolePolicy",
|
|
"iam:UpdateRole",
|
|
"iam:UpdateRoleDescription"
|
|
],
|
|
"Resource": "arn:aws:iam::__ACCOUNT_ID__:role/tf-managed/__STACK_PREFIX__*"
|
|
},
|
|
{
|
|
"Sid": "PassExecRolesToLambda",
|
|
"Effect": "Allow",
|
|
"Action": "iam:PassRole",
|
|
"Resource": "arn:aws:iam::__ACCOUNT_ID__:role/tf-managed/__STACK_PREFIX__*",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"iam:PassedToService": [
|
|
"lambda.amazonaws.com",
|
|
"ecs-tasks.amazonaws.com",
|
|
"scheduler.amazonaws.com"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "IamReadOnly",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:GetPolicy",
|
|
"iam:GetPolicyVersion",
|
|
"iam:GetRole",
|
|
"iam:GetRolePolicy",
|
|
"iam:ListAttachedRolePolicies",
|
|
"iam:ListPolicies",
|
|
"iam:ListPolicyVersions",
|
|
"iam:ListRolePolicies",
|
|
"iam:ListRoles"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "DenySelfMutation",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"iam:AttachRolePolicy",
|
|
"iam:DeleteRole",
|
|
"iam:DeleteRolePolicy",
|
|
"iam:DeleteRolePermissionsBoundary",
|
|
"iam:DetachRolePolicy",
|
|
"iam:PutRolePolicy",
|
|
"iam:PutRolePermissionsBoundary",
|
|
"iam:UpdateAssumeRolePolicy",
|
|
"iam:UpdateRole",
|
|
"iam:UpdateRoleDescription"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:iam::__ACCOUNT_ID__:role/hcptf-*",
|
|
"arn:aws:iam::__ACCOUNT_ID__:role/github-cfn-execution-role",
|
|
"arn:aws:iam::__ACCOUNT_ID__:role/githubdeploy-*",
|
|
"arn:aws:iam::__ACCOUNT_ID__:role/cdk-hnb659fds-*",
|
|
"arn:aws:iam::__ACCOUNT_ID__:role/OrganizationAccountAccessRole",
|
|
"arn:aws:iam::__ACCOUNT_ID__:role/seahaven-*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "DenyBoundaryTampering",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"iam:DeleteRolePermissionsBoundary",
|
|
"iam:DeleteUserPermissionsBoundary"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:iam::__ACCOUNT_ID__:role/*",
|
|
"arn:aws:iam::__ACCOUNT_ID__:user/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "DenyBoundaryPolicyEdit",
|
|
"Effect": "Deny",
|
|
"Action": [
|
|
"iam:CreatePolicyVersion",
|
|
"iam:DeletePolicy",
|
|
"iam:DeletePolicyVersion",
|
|
"iam:SetDefaultPolicyVersion"
|
|
],
|
|
"Resource": "arn:aws:iam::__ACCOUNT_ID__:policy/seahaven-*"
|
|
}
|
|
]
|
|
}
|