Tuesday 21 August 2018

A problem with AWS: IAM Policies

Today I had an issue where I wanted to create a Power Developer user.
So I promptly went to the managed roles and used the Developer Power User and clicked apply.
It seemed ok until I attempted to look at Lambdas and I hit issue after issue with missing roles.
So I have created this policy and it seems ok so far:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "NotAction": [
                "iam:*",
                "organizations:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole",
                "iam:DeleteServiceLinkedRole",
                "iam:ListRoles",
                "iam:ListRolePolicies",
               "iam:GetRole",
               "iam:ListAttachedRolePolicies",
               "iam:GetPolicy",
               "iam:GetPolicyVersion",
                "organizations:DescribeOrganization"
            ],
            "Resource": "*"
        }
    ]
}

The items in bold are the additional rights the policy needed for the Lamda console to work.
Ideally, this should be 'LambdaConsoleRole' or some such but I am still learning.