ansible/hacking/aws_config/testing_policies/security-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:GetGroup",
                "iam:GetInstanceProfile",
                "iam:CreateInstanceProfile",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:GetUser",
                "iam:ListAttachedGroupPolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListGroups",
                "iam:ListInstanceProfiles",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicies",
                "iam:ListRoles",
                "iam:ListRolePolicies",
                "iam:ListUsers",
                "iam:ListAccountAliases"
            ],
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "AllowReadOnlyIAMUse"
        },
        {
            "Action": [
                "iam:AttachRolePolicy",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:DetachRolePolicy",
                "iam:PassRole"
             ],
            "Resource": "arn:aws:iam::{{ aws_account }}:role/ansible-test-*",
            "Effect": "Allow",
            "Sid": "AllowUpdateOfSpecificRoles"
        },
        {
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:AddRoleToInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile"
             ],
            "Resource": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*",
            "Effect": "Allow",
            "Sid": "AllowUpdateOfSpecificInstanceProfiles"
        },
        {
            "Action": [
                "ec2:ReplaceIamInstanceProfileAssociation"
             ],
            "Resource": "*",
            "Condition": {
              "ArnEquals": {
                "ec2:InstanceProfile": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*"
              }
            },
            "Effect": "Allow",
            "Sid": "AllowReplacementOfSpecificInstanceProfiles"
        },
        {
            "Sid": "AllowWAFusage",
            "Action": "waf:*",
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Sid": "AllowListingCloudwatchLogs",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups"
            ],
            "Resource": [
                "arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:*"
            ]
        },
        {
            "Sid": "AllowModifyingCloudwatchLogs",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:PutRetentionPolicy",
                "logs:DeleteLogGroup"
            ],
            "Resource": [
                "arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-testing*"
            ]
        },
        {
            "Sid": "AllowSTSAnsibleTests",
            "Action": [
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:DetachRolePolicy",
                "sts:AssumeRole",
                "iam:AttachRolePolicy",
                "iam:CreateInstanceProfile"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:iam::{{aws_account}}:role/ansible-test-sts-*",
                "arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-sts-*"
            ]
        },
        {
            "Sid": "AllowAccessToUnspecifiedKMSResources",
            "Effect": "Allow",
            "Action": [
                "kms:CancelKeyDeletion",
                "kms:CreateAlias",
                "kms:CreateGrant",
                "kms:CreateKey",
                "kms:DeleteAlias",
                "kms:Describe*",
                "kms:DisableKey",
                "kms:EnableKey",
                "kms:GenerateRandom",
                "kms:Get*",
                "kms:List*",
                "kms:RetireGrant",
                "kms:ScheduleKeyDeletion",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:UpdateGrant",
                "kms:UpdateKeyDescription"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowAccessToSpecifiedIAMResources",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:GetRole",
                "iam:PassRole",
                "iam:UpdateAssumeRolePolicy"
            ],
            "Resource": "arn:aws:iam::{{aws_account}}:role/ansible-test-*"
        },
        {
            "Sid": "AllowInstanceProfileCreation",
            "Effect": "Allow",
            "Action": [
                "iam:AddRoleToInstanceProfile",
                "iam:CreateInstanceProfile",
                "iam:RemoveRoleFromInstanceProfile"
            ],
            "Resource": "arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-*"
        }
    ]
}
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`{`
			`"Version": "2012-10-17",`
			`"Statement": [`
			`{`
			`"Action": [`
Improve iam_group exception handling (#45599) * Improve iam_group exception handling Use AnsibleAWSModule for iam_group and handle BotoCoreErrors as well as ClientErrors. Use fail_json_aws to improve error messages * Add minimal iam_group test suite Update some of the read-only IAM permissions (this is not sufficient to run the test suite but it gets further than it did until it tries to add a (non-existent) user) * Clean up after tests 6 years ago			`"iam:GetGroup",`
sns_topic boto3 port (#39292) * Port sns_topic to boto3 and add tests 6 years ago			`"iam:GetInstanceProfile",`
New module for AWS CodeBuild (#47187) * New AWS module for the CodeBuild service, called aws_codebuild * Integration test for new aws_codebuild module 5 years ago			`"iam:CreateInstanceProfile",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"iam:GetPolicy",`
			`"iam:GetPolicyVersion",`
			`"iam:GetRole",`
sns_topic boto3 port (#39292) * Port sns_topic to boto3 and add tests 6 years ago			`"iam:GetRolePolicy",`
Improve iam_group exception handling (#45599) * Improve iam_group exception handling Use AnsibleAWSModule for iam_group and handle BotoCoreErrors as well as ClientErrors. Use fail_json_aws to improve error messages * Add minimal iam_group test suite Update some of the read-only IAM permissions (this is not sufficient to run the test suite but it gets further than it did until it tries to add a (non-existent) user) * Clean up after tests 6 years ago			`"iam:GetUser",`
			`"iam:ListAttachedGroupPolicies",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"iam:ListAttachedRolePolicies",`
Improve iam_group exception handling (#45599) * Improve iam_group exception handling Use AnsibleAWSModule for iam_group and handle BotoCoreErrors as well as ClientErrors. Use fail_json_aws to improve error messages * Add minimal iam_group test suite Update some of the read-only IAM permissions (this is not sufficient to run the test suite but it gets further than it did until it tries to add a (non-existent) user) * Clean up after tests 6 years ago			`"iam:ListAttachedUserPolicies",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"iam:ListGroups",`
sns_topic boto3 port (#39292) * Port sns_topic to boto3 and add tests 6 years ago			`"iam:ListInstanceProfiles",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"iam:ListInstanceProfilesForRole",`
			`"iam:ListPolicies",`
			`"iam:ListRoles",`
			`"iam:ListRolePolicies",`
added account_alias in the response of module aws_caller_facts (#42345) * added account_alias in the response of module aws_caller_facts * added comment to explain list_account_aliases * renamed caller_identity to caller_facts as the content is extended * created changelog * security-policy needs the iam:ListAccountAliases for this module to work * test now checks for the added field account_alias * gracefully handle missing iam:ListAccountAliases permission 6 years ago			`"iam:ListUsers",`
			`"iam:ListAccountAliases"`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`],`
			`"Resource": "*",`
			`"Effect": "Allow",`
			`"Sid": "AllowReadOnlyIAMUse"`
Add new aws_waf_condition module (#33110) 7 years ago			`},`
Fix ec2_instance eventual consistency when wait: false (#51885) * Do not return 'instances' when wait is false * Added integration tests for wait: false * Added changelog fragment * Fix test suite to work with ec2_instance * Additional permissions * Enforce boto3 version * Fix broken tests * Improve error messages * fix linter issues 6 years ago			`{`
			`"Action": [`
			`"iam:AttachRolePolicy",`
			`"iam:CreateRole",`
			`"iam:DeleteRole",`
			`"iam:DetachRolePolicy",`
			`"iam:PassRole"`
			`],`
			`"Resource": "arn:aws:iam::{{ aws_account }}:role/ansible-test-*",`
			`"Effect": "Allow",`
			`"Sid": "AllowUpdateOfSpecificRoles"`
			`},`
			`{`
			`"Action": [`
			`"iam:CreateInstanceProfile",`
			`"iam:DeleteInstanceProfile",`
			`"iam:AddRoleToInstanceProfile",`
			`"iam:RemoveRoleFromInstanceProfile"`
			`],`
			`"Resource": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*",`
			`"Effect": "Allow",`
			`"Sid": "AllowUpdateOfSpecificInstanceProfiles"`
			`},`
			`{`
			`"Action": [`
			`"ec2:ReplaceIamInstanceProfileAssociation"`
			`],`
			`"Resource": "*",`
			`"Condition": {`
			`"ArnEquals": {`
			`"ec2:InstanceProfile": "arn:aws:iam::{{ aws_account }}:instance-profile/ansible-test-*"`
			`}`
			`},`
			`"Effect": "Allow",`
			`"Sid": "AllowReplacementOfSpecificInstanceProfiles"`
			`},`
Add new aws_waf_condition module (#33110) 7 years ago			`{`
			`"Sid": "AllowWAFusage",`
			`"Action": "waf:*",`
			`"Effect": "Allow",`
			`"Resource": "*"`
[AWS] ses rule set module for inbound email processing (#42781) * Add module ses_rule_set for Amazon SES * Update behaviours and naming to be consistent with other aws_ses_ modules. * Add global lock around tests using active rule sets to prevent intermittent test failures. * Fix deletion of rule sets so that we don't inactivate the active rule set when force deleting an inactive rule set. 6 years ago			`},`
			`{`
			`"Sid": "AllowListingCloudwatchLogs",`
			`"Effect": "Allow",`
			`"Action": [`
			`"logs:DescribeLogGroups"`
			`],`
			`"Resource": [`
			`"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:*"`
			`]`
			`},`
			`{`
			`"Sid": "AllowModifyingCloudwatchLogs",`
			`"Effect": "Allow",`
			`"Action": [`
			`"logs:CreateLogGroup",`
			`"logs:PutRetentionPolicy",`
			`"logs:DeleteLogGroup"`
			`],`
			`"Resource": [`
			`"arn:aws:logs:{{aws_region}}:{{aws_account}}:log-group:ansible-testing*"`
			`]`
Aws waf region (#48953) * Add waiter for AWSRegional * Add support for WAF Regional * Add support for regional waf web acl * Remove set_trace, pep formatting * Add paginator for regional_waf * Change name of param for waf_regional This is more in line with how AWS refers to the service. Additional changes made to how client is called. Used ternary to reduce if statements * Change parameter name to waf_regional * Add support for removal waf regional condition * Change parameter from cloudfront to waf_regional * Added state: absent waf rule * Remove set_trace * Add integration tests for waf regional * WIP: adding region parameter to tests * Add support for waf facts module * Add region to waf regional integration tests * Update security policy for waf regional testing * Add type to documentation for waf_regional param 6 years ago			`},`
			`{`
ecs_cluster test suite refactor (#57716) * Combine testing policies Because of the maximum of 10 policies per group, need to consolidate testing policies as best we can. * Tidy put-account-setting tasks and add permission Using `environment` and `command` rather than `shell` avoids the need for `no_log` and means that people can fix the problem * refactor ecs_cluster test suite move from runme.sh technique to virtualenv use ec2_instance rather than ec2 module to avoid need for boto 5 years ago			`"Sid": "AllowSTSAnsibleTests",`
			`"Action": [`
			`"iam:CreateRole",`
			`"iam:DeleteRole",`
			`"iam:DetachRolePolicy",`
			`"sts:AssumeRole",`
			`"iam:AttachRolePolicy",`
			`"iam:CreateInstanceProfile"`
			`],`
Aws waf region (#48953) * Add waiter for AWSRegional * Add support for WAF Regional * Add support for regional waf web acl * Remove set_trace, pep formatting * Add paginator for regional_waf * Change name of param for waf_regional This is more in line with how AWS refers to the service. Additional changes made to how client is called. Used ternary to reduce if statements * Change parameter name to waf_regional * Add support for removal waf regional condition * Change parameter from cloudfront to waf_regional * Added state: absent waf rule * Remove set_trace * Add integration tests for waf regional * WIP: adding region parameter to tests * Add support for waf facts module * Add region to waf regional integration tests * Update security policy for waf regional testing * Add type to documentation for waf_regional param 6 years ago			`"Effect": "Allow",`
ecs_cluster test suite refactor (#57716) * Combine testing policies Because of the maximum of 10 policies per group, need to consolidate testing policies as best we can. * Tidy put-account-setting tasks and add permission Using `environment` and `command` rather than `shell` avoids the need for `no_log` and means that people can fix the problem * refactor ecs_cluster test suite move from runme.sh technique to virtualenv use ec2_instance rather than ec2 module to avoid need for boto 5 years ago			`"Resource": [`
			`"arn:aws:iam::{{aws_account}}:role/ansible-test-sts-*",`
			`"arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-sts-*"`
			`]`
			`},`
			`{`
			`"Sid": "AllowAccessToUnspecifiedKMSResources",`
			`"Effect": "Allow",`
			`"Action": [`
			`"kms:CancelKeyDeletion",`
			`"kms:CreateAlias",`
			`"kms:CreateGrant",`
			`"kms:CreateKey",`
			`"kms:DeleteAlias",`
			`"kms:Describe*",`
			`"kms:DisableKey",`
			`"kms:EnableKey",`
			`"kms:GenerateRandom",`
			`"kms:Get*",`
			`"kms:List*",`
			`"kms:RetireGrant",`
			`"kms:ScheduleKeyDeletion",`
			`"kms:TagResource",`
			`"kms:UntagResource",`
			`"kms:UpdateGrant",`
			`"kms:UpdateKeyDescription"`
			`],`
Aws waf region (#48953) * Add waiter for AWSRegional * Add support for WAF Regional * Add support for regional waf web acl * Remove set_trace, pep formatting * Add paginator for regional_waf * Change name of param for waf_regional This is more in line with how AWS refers to the service. Additional changes made to how client is called. Used ternary to reduce if statements * Change parameter name to waf_regional * Add support for removal waf regional condition * Change parameter from cloudfront to waf_regional * Added state: absent waf rule * Remove set_trace * Add integration tests for waf regional * WIP: adding region parameter to tests * Add support for waf facts module * Add region to waf regional integration tests * Update security policy for waf regional testing * Add type to documentation for waf_regional param 6 years ago			`"Resource": "*"`
ecs_cluster test suite refactor (#57716) * Combine testing policies Because of the maximum of 10 policies per group, need to consolidate testing policies as best we can. * Tidy put-account-setting tasks and add permission Using `environment` and `command` rather than `shell` avoids the need for `no_log` and means that people can fix the problem * refactor ecs_cluster test suite move from runme.sh technique to virtualenv use ec2_instance rather than ec2 module to avoid need for boto 5 years ago			`},`
			`{`
			`"Sid": "AllowAccessToSpecifiedIAMResources",`
			`"Effect": "Allow",`
			`"Action": [`
			`"iam:CreateRole",`
			`"iam:DeleteRole",`
			`"iam:GetRole",`
			`"iam:PassRole",`
			`"iam:UpdateAssumeRolePolicy"`
			`],`
			`"Resource": "arn:aws:iam::{{aws_account}}:role/ansible-test-*"`
			`},`
			`{`
			`"Sid": "AllowInstanceProfileCreation",`
			`"Effect": "Allow",`
			`"Action": [`
			`"iam:AddRoleToInstanceProfile",`
			`"iam:CreateInstanceProfile",`
			`"iam:RemoveRoleFromInstanceProfile"`
			`],`
			`"Resource": "arn:aws:iam::{{aws_account}}:instance-profile/ansible-test-*"`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`}`
			`]`
			`}`