Skip to content

Instantly share code, notes, and snippets.

@arsdehnel
Last active September 21, 2023 18:12
Show Gist options
  • Save arsdehnel/70e292467ced2a39f472ddca44629c08 to your computer and use it in GitHub Desktop.
Save arsdehnel/70e292467ced2a39f472ddca44629c08 to your computer and use it in GitHub Desktop.
AWS IAM policies for running Terraform from an EC2 instance.
resource "aws_iam_policy" "terraform_create_policy" {
name = "terraform_create_policy"
path = "/"
policy = "${data.aws_iam_policy_document.terraform_create_policy.json}"
}
data "aws_iam_policy_document" "terraform_create_policy" {
statement {
sid = "1"
actions = [
"ec2:CreateNetworkAcl",
"ec2:CreateNetworkAclEntry",
"ec2:CreateNetworkInterface",
"ec2:AttachNetworkInterface",
"autoscaling:AttachLoadbalancers",
"autoscaling:CreateAutoScalingGroup",
"autoscaling:CreateLaunchConfiguration",
"ec2:CreateVpc",
"ec2:DescribeNetworkACLs",
"ec2:DescribeRouteTables",
"ec2:CreateVpc",
"ec2:CreateVpcEndpoint",
"ec2:CreateVpc",
"ec2:CreateVpcPeeringConnection",
"ec2:AcceptVpcPeeringConnection",
"ec2:CreateSubnet",
"ec2:CreateTags",
"ec2:RunInstances",
"ec2:MonitorInstances",
"ec2:CreateSecurityGroup",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateInternetGateway",
"ec2:AttachInternetGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:EnableVGWRoutePropagation",
"ec2:AllocateAddress",
"ec2:AssociateAddress",
"ec2:AssociateRouteTable",
"route53:CreateHealthCheck",
"ec2:CreateVolume",
"ec2:AttachVolume",
"elasticloadbalancing:ApplySecurityGroupsToLoadbalancer",
"elasticloadbalancing:ConfigureHealthCheck",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateLoadBalancerListeners",
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:AddTags",
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"rds:AddTagsToResource",
"iam:CreatePolicyVersion",
"iam:PassRole"
]
resources = [
"*",
]
}
}
resource "aws_iam_policy" "terraform_delete_policy" {
name = "terraform_delete_policy"
path = "/"
policy = "${data.aws_iam_policy_document.terraform_delete_policy.json}"
}
data "aws_iam_policy_document" "terraform_delete_policy" {
statement {
sid = "1"
actions = [
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkAclEntry",
"ec2:DetachNetworkInterface",
"ec2:DeleteNetworkInterface",
"autoscaling:DetachLoadbalancers",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:DeleteLaunchConfiguration",
"ec2:DeleteVpc",
"ec2:DeleteVpcEndpoints",
"ec2:DeleteVpc",
"ec2:DeleteVpc",
"ec2:DeleteVpcPeeringConnection",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:TerminateInstances",
"ec2:UnmonitorInstances",
"ec2:RevokeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:DetachInternetGateway",
"ec2:DeleteInternetGateway",
"ec2:DeleteRoute",
"ec2:DisableVGWRoutePropagation",
"ec2:DisassociateRouteTable",
"ec2:DeleteRouteTable",
"ec2:ReleaseAddress",
"ec2:DisassociateAddress",
"ec2:DisassociateRouteTable",
"route53:DeleteHealthCheck",
"ec2:DeleteVolume",
"ec2:DetachVolume",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancerListeners",
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:RemoveTags",
"iam:DeleteInstanceProfile",
"iam:RemoveRoleFromInstanceProfile"
]
resources = [
"*",
]
}
}
resource "aws_iam_policy" "terraform_read_policy" {
name = "terraform_read_policy"
path = "/"
policy = "${data.aws_iam_policy_document.terraform_read_policy.json}"
}
data "aws_iam_policy_document" "terraform_read_policy" {
statement {
sid = "1"
actions = [
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInterfaceAttributes",
"ec2:DescribeNetworkInterfaces",
"autoscaling:DescribeAutoScalingGroups",
"elasticloadbalancing:DescribeInstanceHealth",
"autoscaling:DescribeLaunchConfiguration",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpc",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeSubnets",
"ec2:DescribeImages",
"ec2:DescribeVolumes",
"ec2:DescribeInstances",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSecurityGroups",
"ec2:DescribeInternetGateways",
"ec2:DescribeRouteTable",
"ec2:DescribeAddresses",
"ec2:DescribeRouteTable",
"route53:GetHostedZone",
"route53:ListResourceRecordSets",
"route53:GetHealthCheck",
"route53:ListTagsForResource",
"ec2:DescribeVolumes",
"ec2:DescribeVolumes",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTags",
"iam:GetInstanceProfile",
"iam:GetPolicy",
"iam:GetRole",
"rds:DescribeDBSubnetGroups",
"elasticloadbalancing:DescribeTargetGroups",
"iam:GetPolicyVersion",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"rds:DescribeDBInstances",
"elasticloadbalancing:DescribeListeners",
"iam:ListEntitiesForPolicy",
"elasticloadbalancing:DescribeRules",
"iam:ListPolicyVersions"
]
resources = [
"*",
]
}
}
resource "aws_iam_policy" "terraform_update_policy" {
name = "terraform_update_policy"
path = "/"
policy = "${data.aws_iam_policy_document.terraform_update_policy.json}"
}
data "aws_iam_policy_document" "terraform_update_policy" {
statement {
sid = "1"
actions = [
"ec2:ReplaceNetworkAclAssociation",
"ec2:ModifyNetworkInterfaceAttribute",
"autoscaling:UpdateAutoScalingGroup",
"ec2:ModifyVpcAttribute",
"ec2:ModifyVpcEndpoint",
"ec2:ModifySubnetAttributes",
"ec2:ModifyInstanceAttribute",
"ec2:ReplaceRouteTableAssociation",
"ec2:ReplaceRouteTableAssociation",
"route53:ChangeResourceRecordSets",
"route53:ChangeTagsForResource",
"route53:UpdateHealthCheck",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"rds:AddTagsToResource"
]
resources = [
"*",
]
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment