Skip to content

Instantly share code, notes, and snippets.

@IngussNeilands

IngussNeilands/packer-permissions.json

Forked from ogrodnek/packer-permissions.json
Created March 2, 2018 16:05
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save IngussNeilands/d2725c20e132c23a621852fec935c8a3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save IngussNeilands/d2725c20e132c23a621852fec935c8a3 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @ogrodnek ogrodnek created this gist Sep 19, 2016.
    111 changes: 111 additions & 0 deletions packer-permissions.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,111 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "NonResourceBasedReadOnlyPermissions",
    "Action": [
    "ec2:DescribeSubnets",
    "ec2:DescribeSnapshots",
    "ec2:DescribeImages",
    "ec2:DescribeVolumes",
    "ec2:DescribeInstances"
    ],
    "Effect": "Allow",
    "Resource": "*"
    },
    {
    "Sid": "NonResourceBasedWritePermissions",
    "Action": [
    "ec2:CopyImage",
    "ec2:CreateImage",
    "ec2:CreateKeyPair",
    "ec2:CreateSecurityGroup",
    "ec2:CreateSnapshot",
    "ec2:CreateTags",
    "ec2:CreateVolume",
    "ec2:DeleteKeypair",
    "ec2:DeleteSnapshot",
    "ec2:ModifyImageAttribute",
    "ec2:ModifyInstanceAttribute",
    "ec2:RegisterImage"
    ],
    "Effect": "Allow",
    "Resource": "*"
    },
    {
    "Sid": "IAMPassroleToInstance",
    "Action": [
    "iam:PassRole"
    ],
    "Effect": "Allow",
    "Resource": "arn:aws:iam::$ACCOUNT_ID:role/packer-inflight-role"
    },
    {
    "Sid": "AllowInstanceActions",
    "Effect": "Allow",
    "Action": [
    "ec2:AttachVolume",
    "ec2:DetachVolume",
    "ec2:StopInstances",
    "ec2:TerminateInstances"

    ],
    "Resource": "arn:aws:ec2:$REGION:$ACCOUNT_ID:instance/*",
    "Condition": {
    "StringEquals": {
    "ec2:InstanceProfile": "arn:aws:iam::$ACCOUNT_ID:instance-profile/packer-inflight-role"
    }
    }
    },
    {
    "Sid": "EC2RunInstances",
    "Effect": "Allow",
    "Action": "ec2:RunInstances",
    "Resource": "arn:aws:ec2:$REGION:$ACCOUNT_ID:instance/*",
    "Condition": {
    "StringEquals": {
    "ec2:InstanceProfile": "arn:aws:iam::$ACCOUNT_ID:instance-profile/packer-inflight-role"
    }
    }
    },
    {
    "Sid": "EC2RunInstancesSubnet",
    "Effect": "Allow",
    "Action": "ec2:RunInstances",
    "Resource": "arn:aws:ec2:$REGION:$ACCOUNT_ID:subnet/*",
    "Condition": {
    "StringEquals": {
    "ec2:vpc": "arn:aws:ec2:$REGION:$ACCOUNT_ID:vpc/$VPC_ID"
    }
    }
    },
    {
    "Sid": "RemainingRunInstancePermissions",
    "Effect": "Allow",
    "Action": "ec2:RunInstances",
    "Resource": [
    "arn:aws:ec2:$REGION:$ACCOUNT_ID:volume/*",
    "arn:aws:ec2:$REGION::image/*",
    "arn:aws:ec2:$REGION::snapshot/*",
    "arn:aws:ec2:$REGION:$ACCOUNT_ID:network-interface/*",
    "arn:aws:ec2:$REGION:$ACCOUNT_ID:key-pair/*",
    "arn:aws:ec2:$REGION:$ACCOUNT_ID:security-group/*",
    "arn:aws:ec2:$REGION:$ACCOUNT_ID:subnet/*"
    ]
    },
    {
    "Sid": "EC2VpcNonresourceSpecificActions",
    "Effect": "Allow",
    "Action": [
    "ec2:AuthorizeSecurityGroupIngress",
    "ec2:DeleteSecurityGroup"
    ],
    "Resource": "*",
    "Condition": {
    "StringEquals": {
    "ec2:vpc": "arn:aws:ec2:$REGION:$ACCOUNT_ID:vpc/$VPC_ID"
    }
    }
    }
    ]
    }