A problem with AWS: IAM Policies
Today I had an issue where I wanted to create a Power Developer user.So I promptly went to the managed roles and used the Developer Power User and clicked apply.
It seemed ok until I attempted to look at Lambdas and I hit issue after issue with missing roles.
So I have created this policy and it seems ok so far:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"NotAction": [
"iam:*",
"organizations:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole",
"iam:DeleteServiceLinkedRole",
"iam:ListRoles",
"iam:ListRolePolicies",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"organizations:DescribeOrganization"
],
"Resource": "*"
}
]
}
The items in bold are the additional rights the policy needed for the Lamda console to work.
Ideally, this should be 'LambdaConsoleRole' or some such but I am still learning.