4 ms·
Small rant--I generally enjoy using AWS products, but WOOF, figuring out all the IAM permissions necessary to get CloudFormation to work is a real PITA.
by balls187 5y ago
Small rant--I generally enjoy using AWS products, but WOOF, figuring out all the IAM permissions necessary to get CloudFormation to work is a real PITA.
- Arelius 5y agoCloudFormation basically needs full account permissions to do it's job. We use separate AWS accounts to provide isolation. It's not great, but we've found it workable.
- jedberg 5y agoAgreed, but you can make it manageable if you do it a lot. First give your CF runner full permissions. Then once you have your CF done and working, take away all permissions from your CF runner. Then add them back one by one as it fails. You can even build a script to run it, check the errors, update IAM, and then run it again. Eventually you'll have a set of IAM least privilege rules. It's a pain but it's secure.
- EE84M3i 5y agoDo the actions from CloudFormation not show up in CloudTrail?
- w1nt3rmut3 5y agoThey do and there is even a button in iam to do just that. Also exposed as api to regernate the policy based on usage.
- balls187 5y agoWould you mind pointing me to a doc about regenerating policies based on usage? The pain I'm dealing with is having to look at the event logs to determine which CF task failed due to permission, then add that to the CF policy.
- orf 5y ago> Would you mind pointing me to a doc about regenerating policies based on usage? First result in Google gift “generate IAM policies from usage” https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_generate-policy.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_poli...