security-services.yaml

Version: '2012-10-17'
Statement:

  - Sid: AllowAssumeRoleTestsAttachAndDetachPolicy
    Effect: Allow
    Action:
      - iam:AttachRolePolicy
      - iam:DetachRolePolicy
    Resource:
      - 'arn:aws:iam::{{ aws_account_id }}:role/ansible-test-*'
      # This is hard coded into DMS...
      - 'arn:aws:iam::{{ aws_account_id }}:role/dms-vpc-role'
    Condition:
      ArnLike:
        iam:PolicyArn:
          - 'arn:aws:iam::aws:policy/AWSDenyAll'
          - 'arn:aws:iam::aws:policy/AmazonEKSServicePolicy'
          - 'arn:aws:iam::aws:policy/AmazonEKSClusterPolicy'
          - 'arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy'
          - 'arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy'
          - 'arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy'
          - 'arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly'
          - 'arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess'
          - 'arn:aws:iam::aws:policy/IAMReadOnlyAccess'
          - 'arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore'
          - 'arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole'
          - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
          - 'arn:aws:iam::aws:policy/service-role/AWSLambdaDynamoDBExecutionRole'
          - 'arn:aws:iam::aws:policy/AWSLambdaInvocation-DynamoDB'
          - 'arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole'
          - 'arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole'
          - 'arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole'
          - 'arn:aws:iam::aws:policy/service-role/AWSServiceRoleForVPCTransitGateway'
          - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
          - 'arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup'
          - 'arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores'
          - 'arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Backup'
          - 'arn:aws:iam::aws:policy/AWSBackupServiceRolePolicyForS3Restore'

  - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - iam:GetUser
      - acm:List*
    Resource: "*"
    Condition:
      StringEquals:
        aws:RequestedRegion:
          - '{{ aws_region }}'

  - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurFees
    Effect: Allow
    Action:
      - kms:CancelKeyDeletion
      - kms:CreateKey
      - kms:GenerateDataKey
      - kms:GenerateRandom
    Resource: "*"
    Condition:
      StringEquals:
        aws:RequestedRegion:
          - '{{ aws_region }}'

  - Sid: AllowGlobalUnrestrictedResourceActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - access-analyzer:ValidatePolicy
      - iam:GetRole
      - iam:List*
      - iam:Tag*
      - iam:Untag*
      - kms:CreateAlias
      - kms:CreateGrant
      - kms:DeleteAlias
      - kms:Describe*
      - kms:Disable*
      - kms:EnableKey*
      - kms:Get*
      - kms:List*
      - kms:PutKeyPolicy
      - kms:RetireGrant
      - kms:ScheduleKeyDeletion
      - kms:Sign
      - kms:TagResource
      - kms:UntagResource
      - kms:UpdateGrant
      - kms:UpdateKeyDescription
      - kms:Verify
      - logs:List*
      - secretsmanager:Describe*
      - secretsmanager:GetRandomPassword
      - secretsmanager:List*
    Resource: "*"

  - Sid: AllowGlobalRestrictedResourceActionsWhichIncurFees
    Effect: Allow
    Action:
      - iam:DeleteServerCertificate
      - iam:UploadServerCertificate
      - secretsmanager:CreateSecret
      - secretsmanager:DeleteSecret
      - secretsmanager:Get*
      - secretsmanager:RotateSecret
      - secretsmanager:TagResource
      - secretsmanager:UntagResource
      - secretsmanager:UpdateSecret
      - secretsmanager:PutResourcePolicy
      - secretsmanager:DeleteResourcePolicy
      - secretsmanager:RemoveRegionsFromReplication
    Resource:
      - 'arn:aws:iam::{{ aws_account_id }}:server-certificate/ansible-test-*'
      - 'arn:aws:secretsmanager:{{ aws_region }}:{{ aws_account_id }}:secret:ansible-test*'

  - Sid: AllowResourceRestrictedActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - acm:AddTagsToCertificate
      - acm:DeleteCertificate
      - acm:Describe*
      - acm:Get*
      - acm:ImportCertificate
      - acm:RemoveTagsFromCertificate
      - acm:RenewCertificate
      - acm:RequestCertificate
      - iam:AddRoleToInstanceProfile
      - iam:CreateInstanceProfile
      - iam:CreateRole
      - iam:CreateSAMLProvider
      - iam:DeleteInstanceProfile
      - iam:DeleteRole
      - iam:DeleteSAMLProvider
      - iam:GetInstanceProfile
      - iam:GetSAMLProvider
      - iam:GetServerCertificate
      - iam:PassRole
      - iam:RemoveRoleFromInstanceProfile
      - iam:UpdateSAMLProvider
      - iam:UpdateServerCertificate
      - kms:Decrypt
      - logs:AssociateKmsKey
      - logs:CreateLogGroup
      - logs:DeleteLogGroup
      - logs:DeleteMetricFilter
      - logs:Describe*
      - logs:DisassociateKmsKey
      - logs:PutMetricFilter
      - logs:PutRetentionPolicy
      - logs:Tag*
      - logs:Untag*
      - sts:AssumeRole
    Resource:
      - 'arn:aws:acm:{{ aws_region }}:{{ aws_account_id }}:certificate/*'
      - 'arn:aws:iam::{{ aws_account_id }}:instance-profile/ansible-test-*'
      - 'arn:aws:iam::{{ aws_account_id }}:saml-provider/ansible-test-*'
      - 'arn:aws:iam::{{ aws_account_id }}:server-certificate/ansible-test-*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/ansible-test-*'
      # dms-vpc-role is hard coded into DMS...
      - 'arn:aws:iam::{{ aws_account_id }}:role/dms-vpc-role'
      - 'arn:aws:iam::{{ aws_account_id }}:role/rds_export_task'
      - 'arn:aws:kms:{{ aws_region }}:{{ aws_account_id }}:key/ansible-test-*'
      - 'arn:aws:logs:{{ aws_region }}:{{ aws_account_id }}:log-group:*'
      - 'arn:aws:logs:{{ aws_region }}:{{ aws_account_id }}:log-group:ansible-test*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS'

  # This allows AWS Services to autmatically create their Default Service Linked Roles
  # These have fixed policies and can only be assumed by the service itself.
  - Sid: AllowServiceLinkedRoleCreation
    Effect: Allow
    Action:
      - iam:CreateServiceLinkedRole
    Resource:
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/autoscaling.amazonaws.com/*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/spot.amazonaws.com/*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-fargate.amazonaws.com/*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-nodegroup.amazonaws.com/*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/transitgateway.amazonaws.com/*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/network-firewall.amazonaws.com/*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/*'
      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/memorydb.amazonaws.com/*'
    Condition:
      ForAnyValue:StringEquals:
        iam:AWSServiceName:
          - 'autoscaling.amazonaws.com'
          - 'spot.amazonaws.com'
          - 'eks-fargate.amazonaws.com'
          - 'eks-nodegroup.amazonaws.com'
          - 'transitgateway.amazonaws.com'
          - 'network-firewall.amazonaws.com'
          - 'ecs.amazonaws.com'
          - 'ecs-test.amazonaws.com'
          - 'memorydb.amazonaws.com'