Skip to content

Instantly share code, notes, and snippets.

@acdcjunior
Created September 15, 2023 01:15
Show Gist options
  • Save acdcjunior/fc8be3e69c05ebe3ca91e32d2badd297 to your computer and use it in GitHub Desktop.
Save acdcjunior/fc8be3e69c05ebe3ca91e32d2badd297 to your computer and use it in GitHub Desktop.
CDK Bootstrap Minimal Permissions
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CdkBoostrapPermissions1of5",
"Action": [
"cloudformation:CreateChangeSet",
"cloudformation:DeleteStack",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStacks",
"cloudformation:ExecuteChangeSet",
"cloudformation:GetTemplate"
],
"Resource": "arn:aws:cloudformation:*:*:stack/CDKToolkit/*",
"Effect": "Allow"
},
{
"Sid": "CdkBoostrapPermissions2of5",
"Action": [
"iam:CreateRole",
"iam:DeleteRole",
"iam:GetRole",
"iam:AttachRolePolicy",
"iam:DetachRolePolicy",
"iam:DeleteRolePolicy",
"iam:PutRolePolicy"
],
"Effect": "Allow",
"Resource": [
"arn:aws:iam::*:policy/*",
"arn:aws:iam::*:role/cdk-*"
]
},
{
"Sid": "CdkBoostrapPermissions3of5",
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:PutBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutBucketVersioning",
"s3:PutEncryptionConfiguration",
"s3:PutLifecycleConfiguration"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::cdk-*"
]
},
{
"Sid": "CdkBoostrapPermissions4of5",
"Action": [
"ssm:DeleteParameter",
"ssm:GetParameter",
"ssm:GetParameters",
"ssm:PutParameter"
],
"Effect": "Allow",
"Resource": [
"arn:aws:ssm:*:*:parameter/cdk-bootstrap/*"
]
},
{
"Sid": "CdkBoostrapPermissions5of5",
"Action": [
"ecr:CreateRepository",
"ecr:DeleteRepository",
"ecr:DescribeRepositories",
"ecr:SetRepositoryPolicy",
"ecr:PutLifecyclePolicy"
],
"Effect": "Allow",
"Resource": [
"arn:aws:ecr:*:*:repository/cdk-*"
]
}
]
}
@acdcjunior
Copy link
Author

Based on aws/aws-cdk#21937 (comment), just added a bunch of Sids.

Just tested it now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment