Skip to content

Commit

Permalink
Update permissions for IAM policies (#103)
Browse files Browse the repository at this point in the history 
* Restrict permissions for config-policy and allow only non-account s3 access.
* Update s3 policy to allow non-account access.
  • Loading branch information
@srpiatt
srpiatt authored Jun 20, 2023
1 parent 0c65d66 commit 0ac97ab
Show file tree
Hide file tree
Showing 4 changed files with 92 additions and 36 deletions.
32 changes: 23 additions & 9 deletions ...packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-linux-instance.cfn.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -130,12 +130,25 @@ Resources:
- 'ssm:GetParametersByPath'
- 'ssm:GetParameter'
Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/config/*'
- Effect: 'Allow'
Action: 's3:GetObject'
Resource:
- 'arn:aws:s3:::*-sec-apps/*.txt'
- 'arn:aws:s3:::*-sec-apps/*.rpm'
- 'arn:aws:s3:::*-sec-apps/*.tar'
- 'arn:aws:s3:::*-sec-apps/*.zip'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
- Effect: 'Allow'
Action: 'secretsmanager:GetSecretValue'
Resource:
- 'arn:aws:secretsmanager:us-east-1:*:secret:v2*lzprod*'
- 'arn:aws:secretsmanager:us-east-1:*:secret:master-fWTVY2'
- Effect: 'Allow'
Action:
- 'secretsmanager:GetSecretValue'
- 'kms:Decrypt'
- 'kms:GenerateDataKey'
- 's3:GetObject'
Resource: '*'
- PolicyName: !Join ['-', [Ref: Namespace, 's3-bootstrap-script-policy']]
PolicyDocument:
Expand All @@ -157,17 +170,18 @@ Resources:
s3:prefix: !Sub
- '${S3Prefix}/*'
- S3Prefix: !Select [3, !Split ['/', !Ref EnvironmentInstanceFiles]]
- PolicyName: !Join ['-', [Ref: Namespace, 's3-get-and-list-any']]
- PolicyName: !Join ['-', [Ref: Namespace, 'allow-non-account-s3-access']]
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
- Effect: 'Allow'
Action:
- s3:GetObject
- s3:List*
Resource:
- 'arn:aws:s3:::embed-aim-ahead'
- 'arn:aws:s3:::embed-aim-ahead/*'
- 's3:GetObject'
- 's3:List*'
Resource: '*'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
PermissionsBoundary: !Ref InstanceRolePermissionBoundary

InstanceProfile:
Expand Down
32 changes: 23 additions & 9 deletions ...ckages/base-raas-cfn-templates/src/templates/service-catalog/ec2-windows-instance.cfn.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -145,12 +145,25 @@ Resources:
- 'ssm:GetParametersByPath'
- 'ssm:GetParameter'
Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/config/*'
- Effect: 'Allow'
Action: 's3:GetObject'
Resource:
- 'arn:aws:s3:::*-sec-apps/*.txt'
- 'arn:aws:s3:::*-sec-apps/*.rpm'
- 'arn:aws:s3:::*-sec-apps/*.tar'
- 'arn:aws:s3:::*-sec-apps/*.zip'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
- Effect: 'Allow'
Action: 'secretsmanager:GetSecretValue'
Resource:
- 'arn:aws:secretsmanager:us-east-1:*:secret:v2*lzprod*'
- 'arn:aws:secretsmanager:us-east-1:*:secret:master-fWTVY2'
- Effect: 'Allow'
Action:
- 'secretsmanager:GetSecretValue'
- 'kms:Decrypt'
- 'kms:GenerateDataKey'
- 's3:GetObject'
Resource: '*'
- PolicyName: !Join ['-', [Ref: Namespace, 's3-bootstrap-script-policy']]
PolicyDocument:
Expand All @@ -172,17 +185,18 @@ Resources:
s3:prefix: !Sub
- '${S3Prefix}/*'
- S3Prefix: !Select [3, !Split ['/', !Ref EnvironmentInstanceFiles]]
- PolicyName: !Join ['-', [Ref: Namespace, 's3-get-and-list-any']]
- PolicyName: !Join ['-', [Ref: Namespace, 'allow-non-account-s3-access']]
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
- Effect: 'Allow'
Action:
- s3:GetObject
- s3:List*
Resource:
- 'arn:aws:s3:::embed-aim-ahead'
- 'arn:aws:s3:::embed-aim-ahead/*'
- 's3:GetObject'
- 's3:List*'
Resource: '*'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
PermissionsBoundary: !Ref InstanceRolePermissionBoundary

InstanceProfile:
Expand Down
32 changes: 23 additions & 9 deletions ...e-raas/packages/base-raas-cfn-templates/src/templates/service-catalog/emr-cluster.cfn.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -245,12 +245,25 @@ Resources:
- 'ssm:GetParametersByPath'
- 'ssm:GetParameter'
Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/config/*'
- Effect: 'Allow'
Action: 's3:GetObject'
Resource:
- 'arn:aws:s3:::*-sec-apps/*.txt'
- 'arn:aws:s3:::*-sec-apps/*.rpm'
- 'arn:aws:s3:::*-sec-apps/*.tar'
- 'arn:aws:s3:::*-sec-apps/*.zip'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
- Effect: 'Allow'
Action: 'secretsmanager:GetSecretValue'
Resource:
- 'arn:aws:secretsmanager:us-east-1:*:secret:v2*lzprod*'
- 'arn:aws:secretsmanager:us-east-1:*:secret:master-fWTVY2'
- Effect: 'Allow'
Action:
- 'secretsmanager:GetSecretValue'
- 'kms:Decrypt'
- 'kms:GenerateDataKey'
- 's3:GetObject'
Resource: '*'
- PolicyName: !Join ['-', [Ref: Namespace, 's3-bootstrap-script-policy']]
PolicyDocument:
Expand All @@ -275,17 +288,18 @@ Resources:
s3:prefix: !Sub
- '${S3Prefix}/*'
- S3Prefix: !Select [3, !Split ['/', !Ref EnvironmentInstanceFiles]]
- PolicyName: !Join ['-', [Ref: Namespace, 's3-get-and-list-any']]
- PolicyName: !Join ['-', [Ref: Namespace, 'allow-non-account-s3-access']]
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
- Effect: 'Allow'
Action:
- s3:GetObject
- s3:List*
Resource:
- 'arn:aws:s3:::embed-aim-ahead'
- 'arn:aws:s3:::embed-aim-ahead/*'
- 's3:GetObject'
- 's3:List*'
Resource: '*'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
PermissionsBoundary: !Ref InstanceRolePermissionBoundary

ServiceRole:
Expand Down
32 changes: 23 additions & 9 deletions ...base-raas-cfn-templates/src/templates/service-catalog/sagemaker-notebook-instance.cfn.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -178,12 +178,25 @@ Resources:
- 'ssm:GetParametersByPath'
- 'ssm:GetParameter'
Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/config/*'
- Effect: 'Allow'
Action: 's3:GetObject'
Resource:
- 'arn:aws:s3:::*-sec-apps/*.txt'
- 'arn:aws:s3:::*-sec-apps/*.rpm'
- 'arn:aws:s3:::*-sec-apps/*.tar'
- 'arn:aws:s3:::*-sec-apps/*.zip'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
- Effect: 'Allow'
Action: 'secretsmanager:GetSecretValue'
Resource:
- 'arn:aws:secretsmanager:us-east-1:*:secret:v2*lzprod*'
- 'arn:aws:secretsmanager:us-east-1:*:secret:master-fWTVY2'
- Effect: 'Allow'
Action:
- 'secretsmanager:GetSecretValue'
- 'kms:Decrypt'
- 'kms:GenerateDataKey'
- 's3:GetObject'
Resource: '*'
- PolicyName: !Join ['-', [Ref: Namespace, 's3-bootstrap-script-policy']]
PolicyDocument:
Expand All @@ -205,17 +218,18 @@ Resources:
s3:prefix: !Sub
- '${S3Prefix}/*'
- S3Prefix: !Select [3, !Split ['/', !Ref EnvironmentInstanceFiles]]
- PolicyName: !Join ['-', [Ref: Namespace, 's3-get-and-list-any']]
- PolicyName: !Join ['-', [Ref: Namespace, 'allow-non-account-s3-access']]
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
- Effect: 'Allow'
Action:
- s3:GetObject
- s3:List*
Resource:
- 'arn:aws:s3:::embed-aim-ahead'
- 'arn:aws:s3:::embed-aim-ahead/*'
- 's3:GetObject'
- 's3:List*'
Resource: '*'
Condition:
StringNotEquals:
s3:ResourceAccount: !Sub '${AWS::AccountId}'
- PolicyName: cw-logs
PolicyDocument:
Statement:
Expand Down

0 comments on commit 0ac97ab

Please sign in to comment.