Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
AWS IAM Policy examples
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:ListUsers"
],
"Resource": "arn:aws:iam::*:*"
},
{
"Effect": "Allow",
"Action": [
"iam:*AccessKey*",
"iam:*Password",
"iam:*MFADevice*",
"iam:UpdateLoginProfile"
],
"Resource": "arn:aws:iam::*:user/${aws:username}"
},
{
"Effect": "Allow",
"Action": [
"iam:CreateVirtualMFADevice",
"iam:DeleteVirtualMFADevice"
],
"Resource": "arn:aws:iam::*:mfa/${aws:username}"
},
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:us-west-1:*:*"
]
},
{
"Action": [
"ec2:Describe*",
"ec2:Create*",
"ec2:Authorize*",
"ec2:Delete*",
"ec2:GetPasswordData",
"ec2:GetConsoleOutput",
"ec2:Modify*",
"ec2:Reset*",
"ec2:MonitorInstances",
"ec2:UnmonitorInstances",
"ec2:*Address"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": "s3:*",
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::<<bucket name>>/*",
"arn:aws:s3:::<<bucket name>>"
]
},
{
"Action": "s3:ListAllMyBuckets",
"Effect": "Allow",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "support:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:ListGroup",
"iam:GetGroup",
"iam:GetGroupPolicy"
],
"Resource": "arn:aws:iam::<<acount number>>:group/<<group name>>"
},
{
"Effect": "Allow",
"Action": [
"rds:Describe*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"rds:*"
],
"Resource": [
"arn:aws:rds:us-west-1:*:*:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:Describe*"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:*"
],
"Resource": [
"arn:aws:elasticloadbalancing:us-west-1:<<account number>>:*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarmHistory",
"cloudwatch:DescribeAlarms",
"cloudwatch:DescribeAlarmsForMetric",
"cloudwatch:DisableAlarmActions",
"cloudwatch:EnableAlarmActions",
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics",
"cloudwatch:PutMetricAlarm",
"cloudwatch:PutMetricData",
"cloudwatch:SetAlarmState"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"sns:*"
],
"Resource": [
"arn:aws:sns:us-west-1:<<account number>>:*"
]
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment