Jon Chery
f874879973
---ci--- project: acdl phase: 0 milestone: v1.2 status: fix ---/ci--- The expanded policy (4727 chars pretty / 3464 compact) exceeded the AWS 2048-char inline policy limit (total across all inline policies on a user). Compressed to 1667 chars by: (1) removing DenyEverythingElse (redundant — IAM is default-deny; the user has no other inline policies), (2) using action-prefix wildcards (ecs:Create*, ecr:Get*, etc.) instead of listing every action, (3) removing SIDs. The compressed policy grants the same effective permissions. The repo file now matches what should be applied in the AWS Console.
106 lines
2.4 KiB
JSON
106 lines
2.4 KiB
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:PutObject",
|
|
"s3:GetObject",
|
|
"s3:DeleteObject",
|
|
"s3:ListBucket",
|
|
"s3:GetBucketLocation",
|
|
"s3:GetBucketVersioning"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
|
|
"arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"dynamodb:GetItem",
|
|
"dynamodb:PutItem",
|
|
"dynamodb:DeleteItem",
|
|
"dynamodb:UpdateItem",
|
|
"dynamodb:Query",
|
|
"dynamodb:Scan",
|
|
"dynamodb:DescribeTable"
|
|
],
|
|
"Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": "sts:GetCallerIdentity",
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecs:Create*",
|
|
"ecs:Describe*",
|
|
"ecs:Delete*",
|
|
"ecs:Update*",
|
|
"ecs:Register*",
|
|
"ecs:Deregister*",
|
|
"ecs:List*"
|
|
],
|
|
"Resource": "arn:aws:ecs:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ecr:Create*",
|
|
"ecr:Describe*",
|
|
"ecr:Delete*",
|
|
"ecr:Get*",
|
|
"ecr:Batch*",
|
|
"ecr:Put*",
|
|
"ecr:Upload*",
|
|
"ecr:Initiate*",
|
|
"ecr:Complete*"
|
|
],
|
|
"Resource": "arn:aws:ecr:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:Create*",
|
|
"elasticloadbalancing:Describe*",
|
|
"elasticloadbalancing:Delete*",
|
|
"elasticloadbalancing:Modify*",
|
|
"elasticloadbalancing:Register*",
|
|
"elasticloadbalancing:Deregister*"
|
|
],
|
|
"Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:Create*",
|
|
"iam:Get*",
|
|
"iam:Delete*",
|
|
"iam:PassRole",
|
|
"iam:Attach*",
|
|
"iam:Detach*",
|
|
"iam:List*",
|
|
"iam:Put*"
|
|
],
|
|
"Resource": "arn:aws:iam::581513795199:*"
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:Create*",
|
|
"ec2:Describe*",
|
|
"ec2:Delete*",
|
|
"ec2:Associate*",
|
|
"ec2:Disassociate*",
|
|
"ec2:Attach*",
|
|
"ec2:Detach*",
|
|
"ec2:Authorize*"
|
|
],
|
|
"Resource": "arn:aws:ec2:us-east-1:581513795199:*"
|
|
}
|
|
]
|
|
} |