Skip to content

Instantly share code, notes, and snippets.

@mtimbs

mtimbs/base-IAM.json

Last active Feb 29, 2020
Embed
What would you like to do?
Base IAM permissions for deploying a serverless project
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"lambda:ListVersionsByFunction",
"s3:CreateBucket",
"lambda:GetFunctionConfiguration",
"cloudformation:DescribeStackResource",
"s3:ListBucket",
"s3:GetBucketPolicy",
"s3:PutEncryptionConfiguration",
"cloudformation:DescribeStackEvents",
"cloudformation:UpdateStack",
"lambda:DeleteFunction",
"s3:DeleteBucket",
"cloudformation:ListStackResources",
"s3:GetBucketPolicyStatus",
"logs:DescribeLogGroups",
"logs:DeleteLogGroup",
"lambda:GetFunction",
"cloudformation:DescribeStackResources",
"s3:DeleteBucketPolicy",
"logs:CreateLogGroup",
"cloudformation:DescribeStacks",
"lambda:AddPermission",
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"s3:PutBucketPolicy",
"lambda:PublishVersion",
"lambda:RemovePermission",
"cloudformation:ValidateTemplate"
],
"Resource": "*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:ListRoleTags",
"apigateway:PUT",
"iam:CreateRole",
"iam:DeleteRole",
"iam:PutRolePolicy",
"s3:PutObject",
"s3:GetObject",
"apigateway:DELETE",
"iam:PassRole",
"iam:DeleteRolePolicy",
"apigateway:POST",
"apigateway:GET",
"s3:DeleteBucket",
"iam:GetRolePolicy"
],
"Resource": [
"arn:aws:s3:::typescript-serverless-*/*",
"arn:aws:iam::*:role/serverless-deploy",
"arn:aws:iam::*:role/typescript-serverless-*",
"arn:aws:apigateway:*::/restapis*"
]
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment