nakada0907/daisuke-iam-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add CloudFormation write IAM role, managed policy, and repository README

Browse source
This commit is contained in:
Daisuke Nakahara 2025-12-31 19:52:14 +09:00
commit ef8bceff67
3 changed files with 111 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

42
policies/cloudformation-write-policy.yaml Normal file
View file

@ -0,0 +1,42 @@
AWSTemplateFormatVersion: '2010-09-09'
Description: CloudFormation Write-Only Managed Policy for Deployment Operations
Resources:
CloudFormationWritePolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
ManagedPolicyName: CloudFormationWrite
Description: Minimal CloudFormation write permissions for deployment operations. Intended for use via AssumeRole, not attached to Permission Sets.
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- cloudformation:CreateStack
- cloudformation:UpdateStack
- cloudformation:DeleteStack
- cloudformation:CreateUploadBucket
- cloudformation:CreateChangeSet
- cloudformation:ExecuteChangeSet
- cloudformation:DescribeStacks
- cloudformation:DescribeStackEvents
- cloudformation:DescribeChangeSet
- cloudformation:ListStacks
- cloudformation:ListChangeSets
- cloudformation:DetectStackDrift
- cloudformation:DetectStackResourceDrift
- cloudformation:DescribeStackDriftDetectionStatus
- cloudformation:ImportStacksToStackSet
- cloudformation:ContinueUpdateRollback
Resource: "*"
- Effect: Allow
Action:
- tag:TagResources
- tag:UntagResources
Resource: "*"
- Effect: Allow
Action:
- s3:PutObject
Resource: "*"