Skip to content

This repo contains IAM Actions required for creating different Terraform AWS Resources with Minimum Access

Notifications You must be signed in to change notification settings

Kaleidoscope-Inc/terraform-iam-policies

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 

Repository files navigation

IAM Actions for Terraform Resources

Terraform Resource Required IAM Actions
aws_app_cookie_stickiness_policy CreateAppCookieStickinessPolicy, DeleteLoadBalancer, DeleteLoadBalancerPolicy, DescribeLoadBalancerPolicies, SetLoadBalancerPoliciesOfListener
aws_autoscaling_group AttachLoadBalancers, CreateAutoScalingGroup, DeleteAutoScalingGroup, DescribeAutoScalingGroups, DescribeInstanceHealth, DetachLoadBalancers, UpdateAutoScalingGroup
aws_autoscaling_notification DeleteNotificationConfiguration, DescribeNotificationConfigurations, PutNotificationConfiguration
aws_autoscaling_policy DeletePolicy, DescribePolicies, PutScalingPolicy
aws_cloudwatch_metric_alarm DeleteAlarms, DescribeAlarms, PutMetricAlarm
aws_customer_gateway CreateCustomerGateway, DeleteCustomerGateway, DescribeCustomerGateways
aws_db_instance CreateDBInstance, CreateDBInstanceReadReplica, DeleteDBInstance, DescribeDBInstances, GetUser, ListTagsForResource, ModifyDBInstance, PromoteReadReplica, RestoreDBInstanceFromDBSnapshot
aws_db_parameter_group CreateDBParameterGroup, DeleteDBParameterGroup, DescribeDBParameterGroups, DescribeDBParameters, ModifyDBParameterGroup
aws_db_security_group AuthorizeDBSecurityGroupIngress, CreateDBSecurityGroup, DeleteDBSecurityGroup, DescribeDBSecurityGroups
aws_db_subnet_group CreateDBSubnetGroup, DeleteDBSubnetGroup
aws_dynamodb_table CreateTable, DeleteTable, DescribeTable UpdateTable
aws_ebs_volume CreateVolume, DeleteVolume, DescribeVolumes
aws_ecs_cluster CreateCluster, DeleteCluster, DescribeClusters
aws_ecs_service CreateService, DeleteService, DescribeServices, GetUser, UpdateService
aws_ecs_task_definition DeregisterTaskDefinition, DescribeTaskDefinition, RegisterTaskDefinition
aws_eip AllocateAddress, AssociateAddress, DescribeAddresses, DisassociateAddress, ReleaseAddress
aws_elasticache_cluster CreateCacheCluster, DeleteCacheCluster, DescribeCacheClusters, GetUser, ListTagsForResource, ModifyCacheCluster
aws_elasticache_parameter_group CreateCacheParameterGroup, DeleteCacheParameterGroup, DescribeCacheParameterGroups, DescribeCacheParameters, ModifyCacheParameterGroup
aws_elasticache_security_group AuthorizeCacheSecurityGroupIngress, CreateCacheSecurityGroup, DeleteCacheSecurityGroup, DescribeCacheSecurityGroups
aws_elasticache_subnet_group CreateCacheSubnetGroup, DeleteCacheSubnetGroup, DescribeCacheSubnetGroups, ModifyCacheSubnetGroup
aws_elb ApplySecurityGroupsToLoadBalancer, ConfigureHealthCheck, CreateLoadBalancer, CreateLoadBalancerListeners, DeleteLoadBalancer, DeleteLoadBalancerListeners, DeregisterInstancesFromLoadBalancer, DescribeLoadBalancerAttributes, DescribeLoadBalancers, DescribeTags, ModifyLoadBalancerAttributes, RegisterInstancesWithLoadBalancer
aws_flow_log CreateFlowLogs, DeleteFlowLogs, DescribeFlowLogs
aws_iam_access_key CreateAccessKey, DeleteAccessKey, ListAccessKeys
aws_iam_group CreateGroup, DeleteGroup, GetGroup
aws_iam_group_membership AddUserToGroup, GetGroup, RemoveUserFromGroup
aws_iam_group_policy DeleteGroup, DeleteGroupPolicy, GetGroup, GetGroupPolicy, PutGroupPolicy
aws_iam_instance_profile AddRoleToInstanceProfile, CreateInstanceProfile, DeleteInstanceProfile, GetInstanceProfile, RemoveRoleFromInstanceProfile
aws_iam_policy CreatePolicy, CreatePolicyVersion, DeletePolicy, DeletePolicyVersion, GetPolicy, ListPolicyVersions
aws_iam_policy_attachment AttachGroupPolicy, AttachRolePolicy, AttachUserPolicy, DetachGroupPolicy, DetachRolePolicy, DetachUserPolicy, GetPolicy, ListEntitiesForPolicy
aws_iam_role CreateRole, DeleteRole, GetRole, ListInstanceProfilesForRole, RemoveRoleFromInstanceProfile
aws_iam_role_policy DeleteRole, DeleteRolePolicy, GetRole, GetRolePolicy, PutRolePolicy
aws_iam_server_certificate DeleteServerCertificate, GetServerCertificate, UploadServerCertificate
aws_iam_user CreateUser, DeleteUser, GetUser
aws_iam_user_policy DeleteUser, DeleteUserPolicy, GetUser, GetUserPolicy, PutUserPolicy
aws_instance DescribeImages, DescribeInstances, DescribeVolumes, ModifyInstanceAttribute, MonitorInstances, RunInstances, TerminateInstances, UnmonitorInstances
aws_internet_gateway AttachInternetGateway, CreateInternetGateway, DeleteInternetGateway, DescribeInternetGateways, DetachInternetGateway
aws_key_pair DeleteKeyPair, DescribeKeyPairs, ImportKeyPair
aws_kinesis_stream CreateStream, DeleteStream, DescribeStream
aws_lambda_function CreateFunction, DeleteFunction, GetFunction
aws_launch_configuration CreateLaunchConfiguration, DeleteLaunchConfiguration, DescribeLaunchConfigurations
aws_lb_cookie_stickiness_policy CreateLBCookieStickinessPolicy, DeleteLoadBalancer, DeleteLoadBalancerPolicy, DescribeLoadBalancerPolicies, SetLoadBalancerPoliciesOfListener
aws_main_route_table_association DescribeRouteTables, ReplaceRouteTableAssociation
aws_network_acl CreateNetworkACL, CreateNetworkACLEntry, DeleteNetworkACL, DeleteNetworkACLEntry, DescribeNetworkACLs, ReplaceNetworkACLAssociation
aws_network_interface AttachNetworkInterface, CreateNetworkInterface, DeleteNetworkInterface, DescribeNetworkInterfaces, DetachNetworkInterface, ModifyNetworkInterfaceAttribute
aws_proxy_protocol_policy CreateLoadBalancer, CreateLoadBalancerPolicy, DeleteLoadBalancer, DeleteLoadBalancerPolicy, DescribeLoadBalancers, SetLoadBalancerPoliciesForBackendServer
aws_route53_health_check CreateHealthCheck, DeleteHealthCheck, GetHealthCheck, ListTagsForResource, UpdateHealthCheck
aws_route53_record ChangeResourceRecordSets, GetHostedZone, ListResourceRecordSets
aws_route_table CreateRoute, CreateRouteTable, DeleteRoute, DeleteRouteTable, DescribeRouteTables, DisableVGWRoutePropagation, DisassociateRouteTable, EnableVGWRoutePropagation
aws_route_table_association AssociateRouteTable, DisassociateRouteTable, ReplaceRouteTableAssociation
aws_s3_bucket CreateBucket, DeleteBucket, DeleteBucketPolicy, DeleteBucketWebsite, DeleteObjects, GetBucketLocation, GetBucketPolicy, GetBucketWebsite, HeadBucket, ListObjects, PutBucketPolicy, PutBucketWebsite
aws_security_group AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateSecurityGroup, DeleteSecurityGroup, DescribeSecurityGroups, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress, CreateTags
aws_security_group_rule AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, DescribeSecurityGroups, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress
aws_sns_topic CreateTopic, DeleteTopic, GetTopicAttributes, SetTopicAttributes
aws_sns_topic_subscription GetSubscriptionAttributes, SetSubscriptionAttributes
aws_spot_instance_request CancelSpotInstanceRequests, DescribeSpotInstanceRequests, RequestSpotInstances
aws_sqs_queue CreateQueue DeleteQueue, GetQueueAttributes, SetQueueAttributes
aws_subnet CreateSubnet, DeleteSubnet, DescribeSubnets, ModifySubnetAttribute
aws_volume_attachment AttachVolume, DescribeVolumes, DetachVolume
aws_vpc CreateVPC, DeleteVPC, DescribeNetworkACLs, DescribeRouteTables, DescribeSecurityGroups, DescribeVPCAttribute, DescribeVPCs, ModifyVPCAttribute
aws_vpc_dhcp_options AssociateDHCPOptions, CreateDHCPOptions, DeleteDHCPOptions, DescribeDHCPOptions, DescribeVPCs
aws_vpc_dhcp_options_association AssociateDHCPOptions
aws_vpc_endpoint CreateVPC, CreateVPCEndpoint, DeleteVPC, DeleteVPCEndpoints, DescribeVPCEndpoints, ModifyVPCEndpoint
aws_vpc_peering_connection AcceptVPCPeeringConnection, CreateVPC, CreateVPCPeeringConnection, DeleteVPC, DeleteVPCPeeringConnection, DescribeVPCPeeringConnections
aws_vpn_connection CreateVPNConnection, DeleteVPNConnection, DescribeVPNConnections
aws_vpn_gateway AttachVPNGateway, CreateVPNGateway, DeleteVPNGateway, DescribeVPNGateways, DetachVPNGateway
vpn_connection_route CreateVPNConnection, CreateVPNConnectionRoute, DeleteVPNConnection, DeleteVPNConnectionRoute, DescribeVPNConnections
s3_tags DeleteBucket, DeleteBucketTagging, GetBucketTagging, PutBucketTagging
tags CreateTags, DeleteTags
tagsEC AddTags, AddTagsToResource, RemoveTags RemoveTagsFromResource
tagsELB AddTags, RemoveTags
tagsRDS AddTags, AddTagsToResource, RemoveTags, RemoveTagsFromResource
tags_route53 ChangeTagsForResource


IAM Policy Actions for Terraform Resources

Terraform Resources AWS Resource CRUD Operation PolicyRule Required FIELD5
aws_network_acl NetworkAcl CREATE ec2:CreateNetworkAcl 1.6.1
aws_network_acl NetworkAcl CREATE ec2:CreateNetworkAclEntry 1.6.1
aws_network_acl NetworkAcl READ ec2:DescribeNetworkAcls 1.6.1
aws_network_acl NetworkAcl UPDATE ec2:ReplaceNetworkAclAssociation 1.6.1
aws_network_acl NetworkAcl DELETE ec2:DeleteNetworkAcl 1.6.1
aws_network_acl NetworkAcl DELETE ec2:DeleteNetworkAclEntry 1.6.1
aws_network_interface NetworkInterface CREATE ec2:CreateNetworkInterface 1.6.1
aws_network_interface NetworkInterface CREATE ec2:AttachNetworkInterface 1.6.1
aws_network_interface NetworkInterface READ ec2:DescribeNetworkInterfaceAttributes 1.6.1
aws_network_interface NetworkInterface READ ec2:DescribeNetworkInterfaces 1.6.1
aws_network_interface NetworkInterface UPDATE ec2:ModifyNetworkInterfaceAttribute 1.6.1
aws_network_interface NetworkInterface DELETE ec2:DetachNetworkInterface 1.6.1
aws_network_interface NetworkInterface DELETE ec2:DeleteNetworkInterface 1.6.1
aws_autoscaling_group AutoScalingGroup CREATE autoscaling:AttachLoadbalancers 1.6.1
aws_autoscaling_group AutoScalingGroup CREATE autoscaling:CreateAutoScalingGroup 1.6.1
aws_autoscaling_group AutoScalingGroup READ autoscaling:DescribeAutoScalingGroups 1.6.1
aws_autoscaling_group AutoScalingGroup READ elasticloadbalancing:DescribeInstanceHealth 1.6.1
aws_autoscaling_group AutoScalingGroup UPDATE autoscaling:UpdateAutoScalingGroup 1.6.1
aws_autoscaling_group AutoScalingGroup DELETE autoscaling:DetachLoadbalancers 1.6.1
aws_autoscaling_group AutoScalingGroup DELETE autoscaling:DeleteAutoScalingGroup 1.6.1
aws_launch_configuration LaunchConfiguration CREATE autoscaling:CreateLaunchConfiguration 1.6.1
aws_launch_configuration LaunchConfiguration READ autoscaling:DescribeLaunchConfiguration 1.6.1
aws_launch_configuration LaunchConfiguration DELETE autoscaling:DeleteLaunchConfiguration 1.6.1
aws_vpc Vpc CREATE ec2:CreateVpc 1.6.1
aws_vpc Vpc CREATE ec2:DescribeNetworkACLs 1.6.1
aws_vpc Vpc CREATE ec2:DescribeRouteTables 1.6.1
aws_vpc Vpc READ ec2:DescribeSecurityGroups 1.6.1
aws_vpc Vpc READ ec2:DescribeVpcAttribute 1.6.1
aws_vpc Vpc READ ec2:DescribeVpc 1.6.1
aws_vpc Vpc UPDATE ec2:ModifyVpcAttribute 1.6.1
aws_vpc Vpc DELETE ec2:DeleteVpc 1.6.1
aws_vpc_endpoint VpcEndpoint CREATE ec2:CreateVpc 1.6.1
aws_vpc_endpoint VpcEndpoint CREATE ec2:CreateVpcEndpoint 1.6.1
aws_vpc_endpoint VpcEndpoint READ ec2:DescribeVpcEndpoints 1.6.1
aws_vpc_endpoint VpcEndpoint UPDATE ec2:ModifyVpcEndpoint 1.6.1
aws_vpc_endpoint VpcEndpoint DELETE ec2:DeleteVpcEndpoints 1.6.1
aws_vpc_endpoint VpcEndpoint DELETE ec2:DeleteVpc 1.6.1
aws_vpc_peering_connection VpcPeeringConnection CREATE ec2:CreateVpc 1.6.1
aws_vpc_peering_connection VpcPeeringConnection CREATE ec2:CreateVpcPeeringConnection 1.6.1
aws_vpc_peering_connection VpcPeeringConnection CREATE ec2:AcceptVpcPeeringConnection 1.6.1
aws_vpc_peering_connection VpcPeeringConnection READ ec2:DescribeVpcPeeringConnections 1.6.1
aws_vpc_peering_connection VpcPeeringConnection DELETE ec2:DeleteVpc 1.6.1
aws_vpc_peering_connection VpcPeeringConnection DELETE ec2:DeleteVpcPeeringConnection 1.6.1
aws_subnet Subnet CREATE ec2:CreateSubnet 1.6.1
aws_subnet Subnet READ ec2:DescribeSubnets 1.6.1
aws_subnet Subnet UPDATE ec2:ModifySubnetAttributes 1.6.1
aws_subnet Subnet DELETE ec2:DeleteSubnet 1.6.1
aws Tags CREATE ec2:CreateTags 1.6.1
aws Tags DELETE ec2:DeleteTags 1.6.1
aws_instance Instance CREATE ec2:RunInstances 1.6.1
aws_instance Instance CREATE ec2:MonitorInstances 1.6.1
aws_instance Instance READ ec2:DescribeImages 1.6.1
aws_instance Instance READ ec2:DescribeVolumes 1.6.1
aws_instance Instance READ ec2:DescribeInstances 1.6.1
aws_instance Instance UPDATE ec2:ModifyInstanceAttribute 1.6.1
aws_instance Instance DELETE ec2:TerminateInstances 1.6.1
aws_instance Instance DELETE ec2:UnmonitorInstances 1.6.1
aws_security_group SecurityGroup CREATE ec2:CreateSecurityGroup 1.6.1
aws_security_group SecurityGroup CREATE ec2:AuthorizeSecurityGroupEgress 1.6.1
aws_security_group SecurityGroup CREATE ec2:AuthorizeSecurityGroupIngress 1.6.1
aws_security_group SecurityGroup CREATE ec2:RevokeSecurityGroupEgress 1.6.1
aws_security_group SecurityGroup CREATE ec2:RevokeSecurityGroupIngress 1.6.1
aws_security_group SecurityGroup READ ec2:DescribeSecurityGroups 1.6.1
aws_security_group SecurityGroup DELETE ec2:RevokeSecurityGroupIngress 1.6.1
aws_security_group SecurityGroup DELETE ec2:RevokeSecurityGroupEgress 1.6.1
aws_security_group SecurityGroup DELETE ec2:DeleteSecurityGroup 1.6.1
aws_security_group_rule SecurityGroupEgress CREATE ec2:AuthorizeSecurityGroupEgress 1.6.1
aws_security_group_rule SecurityGroupEgress READ ec2:DescribeSecurityGroups 1.6.1
aws_security_group_rule SecurityGroupEgress DELETE ec2:RevokeSecurityGroupEgress 1.6.1
aws_security_group_rule SecurityGroupIngress CREATE ec2:AuthorizeSecurityGroupIngress 1.6.1
aws_security_group_rule SecurityGroupIngress READ ec2:DescribeSecurityGroups 1.6.1
aws_security_group_rule SecurityGroupIngress DELETE ec2:RevokeSecurityGroupIngress 1.6.1
aws_internet_gateway InternetGateway CREATE ec2:CreateInternetGateway 1.6.1
aws_internet_gateway InternetGateway CREATE ec2:AttachInternetGateway 1.6.1
aws_internet_gateway InternetGateway READ ec2:DescribeInternetGateways 1.6.1
aws_internet_gateway InternetGateway DELETE ec2:DetachInternetGateway 1.6.1
aws_internet_gateway InternetGateway DELETE ec2:DeleteInternetGateway 1.6.1
aws_route_table Route CREATE ec2:CreateRoute 1.6.1
aws_route_table Route DELETE ec2:DeleteRoute 1.6.1
aws_route_table RouteTable CREATE ec2:CreateRouteTable 1.6.1
aws_route_table RouteTable CREATE ec2:EnableVGWRoutePropagation 1.6.1
aws_route_table RouteTable READ ec2:DescribeRouteTable 1.6.1
aws_route_table RouteTable DELETE ec2:DisableVGWRoutePropagation 1.6.1
aws_route_table RouteTable DELETE ec2:DisassociateRouteTable 1.6.1
aws_route_table RouteTable DELETE ec2:DeleteRouteTable 1.6.1
aws_eip Address CREATE ec2:AllocateAddress 1.6.1
aws_eip Address CREATE ec2:AssociateAddress 1.6.1
aws_eip Address READ ec2:DescribeAddresses 1.6.1
aws_eip Address DELETE ec2:ReleaseAddress 1.6.1
aws_eip Address DELETE ec2:DisassociateAddress 1.6.1
aws_main_route_table_association RouteTable READ ec2:DescribeRouteTable 1.6.1
aws_main_route_table_association RouteTable UPDATE ec2:ReplaceRouteTableAssociation 1.6.1
aws_route_table_association RouteTable CREATE ec2:AssociateRouteTable 1.6.1
aws_route_table_association RouteTable UPDATE ec2:ReplaceRouteTableAssociation 1.6.1
aws_route_table_association RouteTable DELETE ec2:DisassociateRouteTable 1.6.1
aws_route_53_record Route53Record UPDATE route53:ChangeResourceRecordSets 1.6.1
aws_route_53_record Route53Record READ route53:GetHostedZone 1.6.1
aws_route_53_record Route53Record READ route53:ListResourceRecordSets 1.6.1
aws_route_53_record Route53Record UPDATE route53:ChangeTagsForResource 1.6.1
aws_reoute_53_health_check Route53HealthCheck CREATE route53:CreateHealthCheck 1.6.1
aws_reoute_53_health_check Route53HealthCheck READ route53:GetHealthCheck 1.6.1
aws_reoute_53_health_check Route53HealthCheck READ route53:ListTagsForResource 1.6.1
aws_reoute_53_health_check Route53HealthCheck UPDATE route53:UpdateHealthCheck 1.6.1
aws_reoute_53_health_check Route53HealthCheck DELETE route53:DeleteHealthCheck 1.6.1
aws_ebs_volume Volume CREATE ec2:CreateVolume 1.6.1
aws_ebs_volume Volume DELETE ec2:DeleteVolume 1.6.1
aws_ebs_volume Volume READ ec2:DescribeVolumes 1.6.1
aws_volume_attachment Volume CREATE ec2:AttachVolume 1.6.1
aws_volume_attachment Volume READ ec2:DescribeVolumes 1.6.1
aws_volume_attachment Volume DELETE ec2:DetachVolume 1.6.1
aws_elb ElasticLoadBalancer CREATE elasticloadbalancing:ApplySecurityGroupsToLoadbalancer 1.6.1
aws_elb ElasticLoadBalancer CREATE elasticloadbalancing:ConfigureHealthCheck 1.6.1
aws_elb ElasticLoadBalancer CREATE elasticloadbalancing:CreateLoadBalancer 1.6.1
aws_elb ElasticLoadBalancer CREATE elasticloadbalancing:CreateLoadBalancerListeners 1.6.1
aws_elb ElasticLoadBalancer CREATE elasticloadbalancing:RegisterInstancesWithLoadBalancer 1.6.1
aws_elb ElasticLoadBalancer CREATE elasticloadbalancing:AddTags 1.6.1
aws_elb ElasticLoadBalancer READ elasticloadbalancing:DescribeLoadBalancerAttributes 1.6.1
aws_elb ElasticLoadBalancer READ elasticloadbalancing:DescribeLoadBalancers 1.6.1
aws_elb ElasticLoadBalancer READ elasticloadbalancing:DescribeTags 1.6.1
aws_elb ElasticLoadBalancer UPDATE elasticloadbalancing:ModifyLoadBalancerAttributes 1.6.1
aws_elb ElasticLoadBalancer DELETE elasticloadbalancing:DeleteLoadBalancer 1.6.1
aws_elb ElasticLoadBalancer DELETE elasticloadbalancing:DeleteLoadBalancerListeners 1.6.1
aws_elb ElasticLoadBalancer DELETE elasticloadbalancing:DeregisterInstancesFromLoadBalancer 1.6.1
aws_elb ElasticLoadBalancer DELETE elasticloadbalancing:RemoveTags 1.6.1
aws_iam_instance_profile IamInstanceProfile CREATE iam:AddRoleToInstanceProfile 1.6.1
aws_iam_instance_profile IamInstanceProfile CREATE iam:CreateInstanceProfile 1.6.1
aws_iam_instance_profile IamInstanceProfile READ iam:GetInstanceProfile 1.6.1
aws_iam_instance_profile IamInstanceProfile DELETE iam:DeleteInstanceProfile 1.6.1
aws_iam_instance_profile IamInstanceProfile DELETE iam:RemoveRoleFromInstanceProfile 1.6.1


About

This repo contains IAM Actions required for creating different Terraform AWS Resources with Minimum Access

Topics

Resources

Stars

Watchers

Forks