fix: compress spike_runner_policy.json to fit AWS 2048-char inline limit
---ci--- project: acdl phase: 0 milestone: v1.2 status: fix ---/ci--- The expanded policy (4727 chars pretty / 3464 compact) exceeded the AWS 2048-char inline policy limit (total across all inline policies on a user). Compressed to 1667 chars by: (1) removing DenyEverythingElse (redundant — IAM is default-deny; the user has no other inline policies), (2) using action-prefix wildcards (ecs:Create*, ecr:Get*, etc.) instead of listing every action, (3) removing SIDs. The compressed policy grants the same effective permissions. The repo file now matches what should be applied in the AWS Console.
This commit is contained in:
Jon Chery
@@ -2,7 +2,6 @@
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "SpikeStateBucketReadWrite",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:PutObject",
|
||||
@@ -18,7 +17,6 @@
|
||||
]
|
||||
},
|
||||
{
|
||||
"Sid": "SpikeOutboxTableReadWrite",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"dynamodb:GetItem",
|
||||
@@ -32,127 +30,77 @@
|
||||
"Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
|
||||
},
|
||||
{
|
||||
"Sid": "SpikeStsSelfIdentify",
|
||||
"Effect": "Allow",
|
||||
"Action": "sts:GetCallerIdentity",
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "SpikeEcsReadWrite",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ecs:CreateCluster",
|
||||
"ecs:DescribeCluster",
|
||||
"ecs:DeleteCluster",
|
||||
"ecs:CreateService",
|
||||
"ecs:DescribeService",
|
||||
"ecs:UpdateService",
|
||||
"ecs:DeleteService",
|
||||
"ecs:RegisterTaskDefinition",
|
||||
"ecs:DescribeTaskDefinition",
|
||||
"ecs:DeregisterTaskDefinition",
|
||||
"ecs:ListTasks",
|
||||
"ecs:DescribeTasks"
|
||||
"ecs:Create*",
|
||||
"ecs:Describe*",
|
||||
"ecs:Delete*",
|
||||
"ecs:Update*",
|
||||
"ecs:Register*",
|
||||
"ecs:Deregister*",
|
||||
"ecs:List*"
|
||||
],
|
||||
"Resource": "arn:aws:ecs:us-east-1:581513795199:*"
|
||||
},
|
||||
{
|
||||
"Sid": "SpikeEcrReadWrite",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ecr:CreateRepository",
|
||||
"ecr:DescribeRepositories",
|
||||
"ecr:DeleteRepository",
|
||||
"ecr:GetAuthorizationToken",
|
||||
"ecr:BatchCheckLayerAvailability",
|
||||
"ecr:GetDownloadUrlForLayer",
|
||||
"ecr:BatchGetImage",
|
||||
"ecr:CompleteLayerUpload",
|
||||
"ecr:InitiateLayerUpload",
|
||||
"ecr:PutImage",
|
||||
"ecr:UploadLayerPart"
|
||||
"ecr:Create*",
|
||||
"ecr:Describe*",
|
||||
"ecr:Delete*",
|
||||
"ecr:Get*",
|
||||
"ecr:Batch*",
|
||||
"ecr:Put*",
|
||||
"ecr:Upload*",
|
||||
"ecr:Initiate*",
|
||||
"ecr:Complete*"
|
||||
],
|
||||
"Resource": "arn:aws:ecr:us-east-1:581513795199:*"
|
||||
},
|
||||
{
|
||||
"Sid": "SpikeElbReadWrite",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"elasticloadbalancing:CreateLoadBalancer",
|
||||
"elasticloadbalancing:DescribeLoadBalancers",
|
||||
"elasticloadbalancing:DeleteLoadBalancer",
|
||||
"elasticloadbalancing:CreateListener",
|
||||
"elasticloadbalancing:DescribeListeners",
|
||||
"elasticloadbalancing:DeleteListener",
|
||||
"elasticloadbalancing:CreateTargetGroup",
|
||||
"elasticloadbalancing:DescribeTargetGroups",
|
||||
"elasticloadbalancing:DeleteTargetGroup",
|
||||
"elasticloadbalancing:ModifyTargetGroupAttributes",
|
||||
"elasticloadbalancing:RegisterTargets",
|
||||
"elasticloadbalancing:DeregisterTargets"
|
||||
"elasticloadbalancing:Create*",
|
||||
"elasticloadbalancing:Describe*",
|
||||
"elasticloadbalancing:Delete*",
|
||||
"elasticloadbalancing:Modify*",
|
||||
"elasticloadbalancing:Register*",
|
||||
"elasticloadbalancing:Deregister*"
|
||||
],
|
||||
"Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*"
|
||||
},
|
||||
{
|
||||
"Sid": "SpikeIamReadWrite",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:CreateRole",
|
||||
"iam:GetRole",
|
||||
"iam:DeleteRole",
|
||||
"iam:Create*",
|
||||
"iam:Get*",
|
||||
"iam:Delete*",
|
||||
"iam:PassRole",
|
||||
"iam:CreatePolicy",
|
||||
"iam:GetPolicy",
|
||||
"iam:DeletePolicy",
|
||||
"iam:AttachRolePolicy",
|
||||
"iam:DetachRolePolicy",
|
||||
"iam:ListRolePolicies",
|
||||
"iam:ListAttachedRolePolicies",
|
||||
"iam:PutRolePolicy"
|
||||
"iam:Attach*",
|
||||
"iam:Detach*",
|
||||
"iam:List*",
|
||||
"iam:Put*"
|
||||
],
|
||||
"Resource": "arn:aws:iam::581513795199:*"
|
||||
},
|
||||
{
|
||||
"Sid": "SpikeEc2VpcReadWrite",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:CreateVpc",
|
||||
"ec2:DescribeVpcs",
|
||||
"ec2:DeleteVpc",
|
||||
"ec2:CreateSubnet",
|
||||
"ec2:DescribeSubnets",
|
||||
"ec2:DeleteSubnet",
|
||||
"ec2:CreateRouteTable",
|
||||
"ec2:DescribeRouteTables",
|
||||
"ec2:DeleteRouteTable",
|
||||
"ec2:AssociateRouteTable",
|
||||
"ec2:DisassociateRouteTable",
|
||||
"ec2:CreateInternetGateway",
|
||||
"ec2:DescribeInternetGateways",
|
||||
"ec2:DeleteInternetGateway",
|
||||
"ec2:AttachInternetGateway",
|
||||
"ec2:DetachInternetGateway",
|
||||
"ec2:CreateSecurityGroup",
|
||||
"ec2:DescribeSecurityGroups",
|
||||
"ec2:DeleteSecurityGroup",
|
||||
"ec2:AuthorizeSecurityGroupIngress"
|
||||
"ec2:Create*",
|
||||
"ec2:Describe*",
|
||||
"ec2:Delete*",
|
||||
"ec2:Associate*",
|
||||
"ec2:Disassociate*",
|
||||
"ec2:Attach*",
|
||||
"ec2:Detach*",
|
||||
"ec2:Authorize*"
|
||||
],
|
||||
"Resource": "arn:aws:ec2:us-east-1:581513795199:*"
|
||||
},
|
||||
{
|
||||
"Sid": "DenyEverythingElse",
|
||||
"Effect": "Deny",
|
||||
"Action": "*",
|
||||
"NotResource": [
|
||||
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
|
||||
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*",
|
||||
"arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox",
|
||||
"arn:aws:ecs:us-east-1:581513795199:*",
|
||||
"arn:aws:ecr:us-east-1:581513795199:*",
|
||||
"arn:aws:elasticloadbalancing:us-east-1:581513795199:*",
|
||||
"arn:aws:iam::581513795199:*",
|
||||
"arn:aws:ec2:us-east-1:581513795199:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user