ansible/hacking/aws_config/testing_policies/container-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "UnspecifiedCodeRepositories",
            "Effect": "Allow",
            "Action": [
                "ecr:DescribeRepositories",
                "ecr:CreateRepository"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SpecifiedCodeRepositories",
            "Effect": "Allow",
            "Action": [
                "ecr:GetLifecyclePolicy",
                "ecr:PutLifecyclePolicy",
                "ecr:DeleteLifecyclePolicy",
                "ecr:GetRepositoryPolicy",
                "ecr:SetRepositoryPolicy",
                "ecr:DeleteRepository",
                "ecr:DeleteRepositoryPolicy",
                "ecr:DeleteRepositoryPolicy"
            ],
            "Resource": [
                "arn:aws:ecr:{{aws_region}}:{{aws_account}}:repository/ansible-*"
            ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "application-autoscaling:Describe*",
            "application-autoscaling:PutScalingPolicy",
            "application-autoscaling:RegisterScalableTarget",
            "cloudwatch:DescribeAlarms",
            "cloudwatch:PutMetricAlarm",
            "ecs:CreateCluster",
            "ecs:CreateService",
            "ecs:DeleteCluster",
            "ecs:DeleteService",
            "ecs:DeregisterTaskDefinition",
            "ecs:Describe*",
            "ecs:List*",
            "ecs:PutAccountSetting",
            "ecs:RegisterTaskDefinition",
            "ecs:RunTask",
            "ecs:StartTask",
            "ecs:StopTask",
            "ecs:UpdateService",
            "elasticloadbalancing:Describe*",
            "iam:GetInstanceProfile",
            "iam:GetPolicy",
            "iam:GetPolicyVersion",
            "iam:GetRole",
            "iam:ListAttachedRolePolicies",
            "iam:ListGroups",
            "iam:ListRoles",
            "iam:ListUsers"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "eks:CreateCluster",
            "eks:DeleteCluster",
            "eks:DescribeCluster",
            "eks:ListClusters"
          ],
          "Resource": [
            "*"
          ]
        }


    ]
}
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`{`
			`"Version": "2012-10-17",`
			`"Statement": [`
			`{`
			`"Sid": "UnspecifiedCodeRepositories",`
			`"Effect": "Allow",`
			`"Action": [`
			`"ecr:DescribeRepositories",`
			`"ecr:CreateRepository"`
			`],`
			`"Resource": "*"`
			`},`
			`{`
			`"Sid": "SpecifiedCodeRepositories",`
			`"Effect": "Allow",`
			`"Action": [`
Add support for ECR Lifecycle Policies to ecs_ecr (#48997) * Fix copy/pasta for ecs_ecr test names * Add support for lifecycle policies to ecs_ecr New feature for ecs_ecr to support [ECR Lifecycle Policies][]. Fixes #32003 [ECR Lifecycle Policies]: https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html * Improve error message for ecs_ecr parsing errors Replaces the exception and stack trace with a description of what's actually going wrong from a user perspective. * Rename delete policy to purge policy Marks the `delete_policy` parameter as deprecated, to be removed in Ansible 2.6. * Add version_added to purge_policy * Remove changing results based on verbosity What I really want is --diff support, and changing results based on verbosity is abnormal. * Ensure repository name is lowercase * Fix deprecation cycle to 4 releases * Use a YAML anchor for credentials * Remove filters from assertions * Add minimal permissions needed * Updating version_added and deprecation cycle The original PR sat while a few releases happened. * Bumping version added and deprecation version We missed the 2.8 release. * Removing bare except: This is not allowed and is generally bad practice. * Fix lint errors * update ansible release metadata * Use the new alias deprecation scheme This was added in the time the PR has been in development, so rework things to use it. * Add test coverage This makes sure that lifecycle_policy is produced when passed in. Also a minor suggestion for simplification from PR. Restore changes from 62871 lost in rebase * Add changelog * Remove version_added for new purge_policy option Per sanity test fail. 5 years ago			`"ecr:GetLifecyclePolicy",`
			`"ecr:PutLifecyclePolicy",`
			`"ecr:DeleteLifecyclePolicy",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"ecr:GetRepositoryPolicy",`
			`"ecr:SetRepositoryPolicy",`
			`"ecr:DeleteRepository",`
			`"ecr:DeleteRepositoryPolicy",`
			`"ecr:DeleteRepositoryPolicy"`
			`],`
			`"Resource": [`
			`"arn:aws:ecr:{{aws_region}}:{{aws_account}}:repository/ansible-*"`
			`]`
			`},`
			`{`
			`"Effect": "Allow",`
			`"Action": [`
			`"application-autoscaling:Describe*",`
			`"application-autoscaling:PutScalingPolicy",`
			`"application-autoscaling:RegisterScalableTarget",`
			`"cloudwatch:DescribeAlarms",`
			`"cloudwatch:PutMetricAlarm",`
			`"ecs:CreateCluster",`
			`"ecs:CreateService",`
[aws]Add VPC configuration to ECS modules (#34381) Enable awsvpc network mode for ECS services and tasks and their underlying task definitions Improve test suite to thoroughly test the changes Use runme.sh technique to run old and new versions of botocore to ensure that the modules work with older botocore and older network modes and fail gracefully if awsvpc network mode is used with older botocore 7 years ago			`"ecs:DeleteCluster",`
			`"ecs:DeleteService",`
			`"ecs:DeregisterTaskDefinition",`
			`"ecs:Describe*",`
			`"ecs:List*",`
ecs_cluster test suite refactor (#57716) * Combine testing policies Because of the maximum of 10 policies per group, need to consolidate testing policies as best we can. * Tidy put-account-setting tasks and add permission Using `environment` and `command` rather than `shell` avoids the need for `no_log` and means that people can fix the problem * refactor ecs_cluster test suite move from runme.sh technique to virtualenv use ec2_instance rather than ec2 module to avoid need for boto 5 years ago			`"ecs:PutAccountSetting",`
[aws]Add VPC configuration to ECS modules (#34381) Enable awsvpc network mode for ECS services and tasks and their underlying task definitions Improve test suite to thoroughly test the changes Use runme.sh technique to run old and new versions of botocore to ensure that the modules work with older botocore and older network modes and fail gracefully if awsvpc network mode is used with older botocore 7 years ago			`"ecs:RegisterTaskDefinition",`
			`"ecs:RunTask",`
Add launch type to ecs task (#49081) * adds fargate launch_type to ecs_task module * White space changes * fix documentation for running ecs task on fargate * remove extraneous example from ecs_task * White space changes * Adds changelog fragment * Pluralize minor_changes in changelog fragment * Add Stop and Start task permissions 6 years ago			`"ecs:StartTask",`
			`"ecs:StopTask",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"ecs:UpdateService",`
			`"elasticloadbalancing:Describe*",`
Fix EC2 test suite to work with testing policies (#44387) * Update testing policies to ensure all required permissions are present * Tidy up security policies to reduce duplicate permissions * Make roles static so that they can be present before CI is run, meaning that role creation permission is not required by the CI itself, only by someone setting up the roles prior to testing * Move contents to cloudfront policy to network policy to ensure policy count (maximum of 10) stays low * Maintain compute policy below 6144 bytes 5 years ago			`"iam:GetInstanceProfile",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"iam:GetPolicy",`
			`"iam:GetPolicyVersion",`
			`"iam:GetRole",`
			`"iam:ListAttachedRolePolicies",`
			`"iam:ListGroups",`
[aws]Add VPC configuration to ECS modules (#34381) Enable awsvpc network mode for ECS services and tasks and their underlying task definitions Improve test suite to thoroughly test the changes Use runme.sh technique to run old and new versions of botocore to ensure that the modules work with older botocore and older network modes and fail gracefully if awsvpc network mode is used with older botocore 7 years ago			`"iam:ListRoles",`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`"iam:ListUsers"`
			`],`
			`"Resource": [`
			`"*"`
			`]`
aws_eks_cluster: New module for managing AWS EKS (#41183) * aws_eks: New module for managing AWS EKS aws_eks module is used for creating and removing EKS clusters. Includes full test suite and updates to IAM policies to enable it. * Clean up all security groups * appease shippable * Rename aws_eks module to aws_eks_cluster 6 years ago			`},`
			`{`
			`"Effect": "Allow",`
			`"Action": [`
			`"eks:CreateCluster",`
			`"eks:DeleteCluster",`
			`"eks:DescribeCluster",`
			`"eks:ListClusters"`
			`],`
			`"Resource": [`
			`"*"`
			`]`
[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`}`
aws_eks_cluster: New module for managing AWS EKS (#41183) * aws_eks: New module for managing AWS EKS aws_eks module is used for creating and removing EKS clusters. Includes full test suite and updates to IAM policies to enable it. * Clean up all security groups * appease shippable * Rename aws_eks module to aws_eks_cluster 6 years ago

[cloud] Create ECS integration test suite (#33757) Tests for: * ecs_cluster * ecs_service * ecs_service_facts * ecs_taskdefinition * ecs_taskdefinition_facts * Add idempotency testing Test ecs_cluster, ecs_service and ecs_taskdefinition for trivial idempotency. Add FIXMEs to the tests because the latter two fail. Remove unused dependencies 7 years ago			`]`
			`}`