Uploaded image for project: 'Documentation'
  1. Documentation
  2. DOCS-4085

Document the minimal IAM permissions necessary for the key given to MMS Automation

    XMLWordPrintableJSON

Details

    • Icon: Task Task
    • Resolution: Done
    • Icon: Critical - P2 Critical - P2
    • v1.3.12
    • None
    • Cloud Manager
    • None

    Description

      For provisioning/automation:

      When a user gives us keys to their AWS account, those keys are associated with a particular AWS IAM user. That user must have a minimum set of permissions in order for MMS to successfully provision machines. If not, provisioning will fail because it is not authorized to complete api requests with Amazon.

      The user should have an IAM user policy with the below actions included at a minimum

      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "Stmt1411574112000",
            "Effect": "Allow",
            "Action": ["iam:*AccessKey*"],
            "Resource": ["arn:aws:iam::*:user/mms-build"]
          },
       
          {
            "Sid": "SomeOtherId",
            "Effect": "Allow",
            "Action": [
              "ec2:AttachVolume",
              "ec2:CreateKeyPair",
              "ec2:CreateSecurityGroup",
              "ec2:CreateTags",
              "ec2:CreateVolume",
              "ec2:DeleteKeyPair",
              "ec2:DeleteSecurityGroup",
              "ec2:DeleteTags",
              "ec2:DeleteVolume",
              "ec2:DescribeAccountAttributes",
              "ec2:DescribeAvailabilityZones",
              "ec2:DescribeInstanceAttribute",
              "ec2:DescribeInstanceStatus",
              "ec2:DescribeInstances",
              "ec2:DescribeKeyPairs",
              "ec2:DescribeRegions",
              "ec2:DescribeSecurityGroups",
              "ec2:DescribeSubnets",
              "ec2:DescribeTags",
              "ec2:DescribeVpcs",
              "ec2:DescribeVolumeAttribute",
              "ec2:DescribeVolumeStatus",
              "ec2:DescribeVolumes",
              "ec2:ImportKeyPair",
              "ec2:RunInstances",
              "ec2:StartInstances",
              "ec2:StopInstances",	  
              "ec2:RebootInstances",
              "ec2:TerminateInstances"
            ],
            "Resource": [
              "*"
            ]
          }
        ]
      }

      Attachments

        Activity

          People

            bgrabar Bob Grabar
            cadran.cowansage Cadran Cowansage
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:
              9 years, 19 weeks, 4 days ago