mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-04-25 11:51:26 -07:00
Split up testing IAM policies and automate creating them (#26223)
* Split up testing IAM policies and automate creating them Move to managed policies to avoid the 5KB limit on policies for an IAM entity. The policy file is templated, so need to make sure that there is an easy mechanism to populate the templates and push the new policies. * Update IAM policies for ec2_scaling_policy tests * Fix RouteTable policies DescribeRouteTable should be plural ModifyRouteTable does not exist, but ReplaceRouteTableAssociation does. * Some IAM policies do not allow specified Resources Various IAM policies do not allow Resources to be specified and should just use `*`. This differs per service * [Autoscaling](http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources) * [EC2](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions) * [ECR](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-supported-iam-actions-resources.html) * [ELB](http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html) * Finish fixing AWS IAM resource specifications for testing Update Lambda and RDS policies
This commit is contained in:
Will Thames
GitHub
parent
4f01a323a0
commit
0ed1c3ba9c
9 changed files with 345 additions and 246 deletions
33
hacking/aws_config/testing_policies/autoscaling-policy.json
Normal file
33
hacking/aws_config/testing_policies/autoscaling-policy.json
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
{# Not all Autoscaling API Actions allow specified resources #}
|
||||
{# See http://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources #}
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "DescribeAutoscaling",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"autoscaling:DescribeAutoScalingGroups",
|
||||
"autoscaling:DescribeLaunchConfigurations",
|
||||
"autoscaling:DescribePolicies"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "AllowAutoscaling",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"autoscaling:CreateLaunchConfiguration",
|
||||
"autoscaling:CreateAutoScalingGroup",
|
||||
"autoscaling:UpdateAutoScalingGroup",
|
||||
"autoscaling:DeleteAutoScalingGroup",
|
||||
"autoscaling:DeleteLaunchConfiguration",
|
||||
"autoscaling:PutScalingPolicy",
|
||||
"autoscaling:DeletePolicy"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:autoscaling:{{aws_region}}:{{aws_account}}:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
51
hacking/aws_config/testing_policies/ec2-policy.json
Normal file
51
hacking/aws_config/testing_policies/ec2-policy.json
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
{# Note that not all EC2 API Actions allow a specific resource #}
|
||||
{# See http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions #}
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowUnspecifiedEC2Resource",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:AllocateAddress",
|
||||
"ec2:AssociateAddress",
|
||||
"ec2:AssociateRouteTable",
|
||||
"ec2:AttachInternetGateway",
|
||||
"ec2:CreateInternetGateway",
|
||||
"ec2:CreateKeyPair",
|
||||
"ec2:CreateNatGateway",
|
||||
"ec2:CreateRouteTable",
|
||||
"ec2:CreateSecurityGroup",
|
||||
"ec2:CreateSubnet",
|
||||
"ec2:CreateVpc",
|
||||
"ec2:DeleteKeyPair",
|
||||
"ec2:DeleteNatGateway",
|
||||
"ec2:Describe*",
|
||||
"ec2:DisassociateAddress",
|
||||
"ec2:DisassociateRouteTable",
|
||||
"ec2:ImportKeyPair",
|
||||
"ec2:ModifyVpcAttribute",
|
||||
"ec2:ReleaseAddress",
|
||||
"ec2:ReplaceRouteTableAssociation"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "AllowSpecifiedEC2Resource",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:AuthorizeSecurityGroupIngress",
|
||||
"ec2:CreateTags",
|
||||
"ec2:DeleteRouteTable",
|
||||
"ec2:DeleteSecurityGroup",
|
||||
"ec2:RevokeSecurityGroupEgress",
|
||||
"ec2:RevokeSecurityGroupIngress",
|
||||
"ec2:RunInstances",
|
||||
"ec2:TerminateInstances"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:ec2:{{aws_region}}:{{aws_account}}:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
28
hacking/aws_config/testing_policies/ecr-policy.json
Normal file
28
hacking/aws_config/testing_policies/ecr-policy.json
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "UnspecifiedCodeRepositories",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ecr:DescribeRepositories",
|
||||
"ecr:CreateRepository"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "SpecifiedCodeRepositories",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ecr:GetRepositoryPolicy",
|
||||
"ecr:SetRepositoryPolicy",
|
||||
"ecr:DeleteRepository",
|
||||
"ecr:DeleteRepositoryPolicy",
|
||||
"ecr:DeleteRepositoryPolicy"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:ecr:{{aws_region}}:{{aws_account}}:repository/ansible-*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
31
hacking/aws_config/testing_policies/elb-policy.json
Normal file
31
hacking/aws_config/testing_policies/elb-policy.json
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
{# According to http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html #}
|
||||
{# Resource level access control is not possible for the new ELB API (providing Application Load Balancer functionality #}
|
||||
{# While it remains possible for the old API, there is no distinction of the Actions between old API and new API #}
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowLoadBalancerOperations",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"elasticloadbalancing:ConfigureHealthCheck",
|
||||
"elasticloadbalancing:CreateLoadBalancer",
|
||||
"elasticloadbalancing:CreateLoadBalancerListeners",
|
||||
"elasticloadbalancing:DeleteLoadBalancer",
|
||||
"elasticloadbalancing:DeleteLoadBalancerListeners",
|
||||
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
|
||||
"elasticloadbalancing:DescribeInstanceHealth",
|
||||
"elasticloadbalancing:DescribeLoadBalancerAttributes",
|
||||
"elasticloadbalancing:DescribeLoadBalancerPolicies",
|
||||
"elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
|
||||
"elasticloadbalancing:DescribeLoadBalancerTags",
|
||||
"elasticloadbalancing:DescribeLoadBalancers",
|
||||
"elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer",
|
||||
"elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer",
|
||||
"elasticloadbalancing:ModifyLoadBalancerAttributes",
|
||||
"elasticloadbalancing:RegisterInstancesWithLoadBalancer"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
77
hacking/aws_config/testing_policies/lambda-policy.json
Normal file
77
hacking/aws_config/testing_policies/lambda-policy.json
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
{# Only certain lambda actions can be restricted to a specific resource #}
|
||||
{# http://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html #}
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowApiGateway",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"apigateway:*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:apigateway:{{aws_region}}::/*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Sid": "AllowGetUserForLambdaCreation",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:GetUser"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:iam::{{aws_account}}:user/ansible_integration_tests"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Sid": "AllowLambdaManagementWithoutResource",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"lambda:CreateEventSourceMapping",
|
||||
"lambda:GetAccountSettings",
|
||||
"lambda:GetEventSourceMapping",
|
||||
"lambda:ListEventSourceMappings",
|
||||
"lambda:ListFunctions",
|
||||
"lambda:ListTags",
|
||||
"lambda:TagResource",
|
||||
"lambda:UntagResource"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "AllowLambdaManagementWithResource",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"lambda:AddPermission",
|
||||
"lambda:CreateAlias",
|
||||
"lambda:CreateFunction",
|
||||
"lambda:DeleteAlias",
|
||||
"lambda:DeleteFunction",
|
||||
"lambda:GetAlias",
|
||||
"lambda:GetFunction",
|
||||
"lambda:GetFunctionConfiguration",
|
||||
"lambda:GetPolicy",
|
||||
"lambda:InvokeFunction",
|
||||
"lambda:ListAliases",
|
||||
"lambda:ListVersionsByFunction",
|
||||
"lambda:PublishVersion",
|
||||
"lambda:RemovePermission",
|
||||
"lambda:UpdateAlias",
|
||||
"lambda:UpdateEventSourceMapping",
|
||||
"lambda:UpdateFunctionCode",
|
||||
"lambda:UpdateFunctionConfiguration"
|
||||
],
|
||||
"Resource": "arn:aws:lambda:{{aws_region}}:{{aws_account}}:function:*"
|
||||
},
|
||||
{
|
||||
"Sid": "AllowLambdaRoleManagement",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:PassRole"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:iam::{{aws_account}}:role/ansible_lambda_role"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
51
hacking/aws_config/testing_policies/rds-policy.json
Normal file
51
hacking/aws_config/testing_policies/rds-policy.json
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowRDSModuleTests",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"rds:DescribeDBInstances",
|
||||
"rds:CreateDBInstance",
|
||||
"rds:ModifyDBInstance",
|
||||
"rds:ListTagsForResource",
|
||||
"rds:DeleteDBInstance"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:db:ansible-testing*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Sid": "AllowRDSInstanceManageOwnInstance",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"rds:CreateDBInstance",
|
||||
"rds:ModifyDBInstance",
|
||||
"rds:ListTagsForResource",
|
||||
"rds:DescribeDBInstances"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:db:rds-*"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Sid": "AllowRDSSnapshotManageSnapshots",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"rds:DescribeDBSnapshots",
|
||||
"rds:DescribeDBInstances",
|
||||
"rds:DescribeDBSnapshots",
|
||||
"rds:DeleteDBInstance",
|
||||
"rds:CreateDBSnapshot",
|
||||
"rds:DeleteDBSnapshot",
|
||||
"rds:RestoreDBInstanceFromDBSnapshot",
|
||||
"rds:CreateDBInstanceReadReplica"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:snapshot:snapshot-*",
|
||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:snapshot:rds-*",
|
||||
"arn:aws:rds:{{aws_region}}:{{aws_account}}:db:rds-*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
23
hacking/aws_config/testing_policies/s3-policy.json
Normal file
23
hacking/aws_config/testing_policies/s3-policy.json
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AlowS3AnsibleTestBuckets",
|
||||
"Action": [
|
||||
"s3:GetObject",
|
||||
"s3:ListBucket",
|
||||
"s3:PutBucketAcl",
|
||||
"s3:CreateBucket",
|
||||
"s3:PutObject",
|
||||
"s3:PutObjectAcl",
|
||||
"s3:DeleteBucket",
|
||||
"s3:DeleteObject"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": [
|
||||
"arn:aws:s3:::ansible_test_*",
|
||||
"arn:aws:s3:::ansible_test_*/*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue