IAM Policy (Start Here)¶
TRiA supports a large number of AWS services and adds services regularly. To access these services, we recommend using either a read-only policy or a power-user policy.
If you are interested in operating in a read-only fashion, which will prevent TRiA from taking actions against your AWS resources, then we recommend using the TRiA Standard User Policy.
If you would like to use TRiA to manage your AWS resources directly or through the use of Bots, then use the TRiA Power User Policy. (Interested in AWS GovCloud? Try these policies instead.)
TRiA Standard User Policy¶
TRiA Standard User Policy - Part 1 of 2¶
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"acm:DescribeCertificate",
"acm:ListCertificates",
"acm:ListTagsForCertificate",
"apigateway:GET",
"apigateway:GetApiKeys",
"apigateway:GetAuthorizers",
"apigateway:GetRestApiKeys",
"apigateway:GetRestApis",
"apigateway:GetRestStages",
"autoscaling:DescribeAutoScalingGroups",
"autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeTags",
"cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResources",
"cloudformation:DescribeStacks",
"cloudformation:GetTemplate",
"cloudformation:ListStackResources",
"cloudformation:ListStacks",
"cloudfront:GetDistribution",
"cloudfront:GetStreamingDistribution",
"cloudfront:ListDistributions",
"cloudfront:ListStreamingDistributions",
"cloudfront:ListTagsForResource",
"cloudsearch:DescribeAvailabilityOptions",
"cloudsearch:DescribeDomains",
"cloudsearch:DescribeServiceAccessPolicies",
"cloudsearch:ListDomainNames",
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetTrailStatus",
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics",
"config:DescribeConfigurationRecorderStatus",
"config:DescribeConfigurationRecorders",
"config:DescribeDeliveryChannelStatus",
"config:DescribeDeliveryChannels",
"dax:DescribeClusters",
"dax:DescribeTable",
"dax:ListTags",
"dax:ListTables",
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeGlobalTable",
"dynamodb:DescribeTable",
"dynamodb:ListBackups",
"dynamodb:ListGlobalTables",
"dynamodb:ListTables",
"dynamodb:ListTagsOfResource",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeFlowLogs",
"ec2:DescribeHosts",
"ec2:DescribeImageAttribute",
"ec2:DescribeImages",
"ec2:DescribeImportImageTasks",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeKeyPairs",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePlacementGroups",
"ec2:DescribeRegions",
"ec2:DescribeReservedInstances",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeVolumeStatus",
"ec2:DescribeVolumes",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:GetPasswordData",
"ec2:GetConsoleOutput",
"workmail:Describe*",
"workmail:Get*",
"workmail:List*",
"workmail:Search*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
TRiA Standard User Policy - Part 2 of 2¶
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ecr:DescribeImages",
"ecr:DescribeRepositories",
"ecr:GetRepositoryPolicy",
"ecr:ListTagsForResource",
"ecs:DescribeClusters",
"ecs:DescribeContainerInstances",
"ecs:DescribeTaskDefinition",
"ecs:DescribeTasks",
"ecs:ListClusters",
"ecs:ListContainerInstances",
"ecs:ListTaskDefinitions",
"ecs:ListTasks",
"eks:DescribeCluster",
"eks:ListClusters",
"elasticache:DescribeCacheClusters",
"elasticache:DescribeCacheSubnetGroups",
"elasticache:DescribeSnapshots",
"elasticache:ListTagsForResource",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeMountTargetSecurityGroups",
"elasticfilesystem:DescribeMountTargets",
"elasticfilesystem:DescribeTags",
"elasticloadbalancing:DescribeInstanceHealth",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:ListClusters",
"elasticmapreduce:ListInstances",
"es:DescribeElasticsearchDomains",
"es:ListDomainNames",
"es:ListTags",
"events:DescribeEventBus",
"events:ListRules",
"events:ListTargetsByRule",
"directconnect:DescribeConnections",
"firehose:DescribeDeliveryStream",
"firehose:ListDeliveryStreams",
"firehose:ListTagsForDeliveryStream",
"fsx:DescribeFileSystems",
"guardduty:GetDetector",
"guardduty:GetFindings",
"guardduty:GetMasterAccount",
"guardduty:ListDetectors",
"guardduty:ListFindings",
"guardduty:ListMembers",
"iam:GenerateCredentialReport",
"iam:GetAccessKeyLastUsed",
"iam:GetAccountAuthorizationDetails",
"iam:GetAccountPasswordPolicy",
"iam:GetAccountSummary",
"iam:GetCredentialReport",
"iam:GetLoginProfile",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetSAMLProvider",
"iam:GetServerCertificate",
"iam:GetUser",
"iam:GetUserPolicy",
"iam:ListAccessKeys",
"iam:ListAttachedGroupPolicies",
"iam:ListAttachedRolePolicies",
"iam:ListAttachedUserPolicies",
"iam:ListGroupPolicies",
"iam:ListGroups",
"iam:ListGroupsForUser",
"iam:ListInstanceProfiles",
"iam:ListMFADevices",
"iam:ListPolicies",
"iam:ListPolicyVersions",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:ListSAMLProviders",
"iam:ListServerCertificates",
"iam:ListSigningCertificates",
"iam:ListUserPolicies",
"iam:ListUsers",
"kinesis:DescribeStream",
"kinesis:ListShards",
"kinesis:ListStreams",
"kinesis:ListTagsForStream",
"kms:DescribeKey",
"kms:GetKeyPolicy",
"kms:GetKeyRotationStatus",
"kms:ListAliases",
"kms:ListKeys",
"lambda:GetAccountSettings",
"lambda:ListFunctions",
"lambda:ListTags",
"logs:DescribeLogGroups",
"organizations:DescribeOrganization",
"organizations:ListAccounts",
"pricing:GetProducts",
"rds:DescribeDBClusterSnapshots",
"rds:DescribeDBClusters",
"rds:DescribeDBEngineVersions",
"rds:DescribeDBInstances",
"rds:DescribeDBSnapshots",
"rds:DescribeReservedDBInstances",
"rds:ListTagsForResource",
"redshift:DescribeClusterParameterGroups",
"redshift:DescribeClusterParameters",
"redshift:DescribeClusterSnapshots",
"redshift:DescribeClusters",
"redshift:DescribeTags",
"route53:GetHostedZone",
"route53:ListGeoLocations",
"route53:ListHealthChecks",
"route53:ListHostedZones",
"route53:ListHostedZonesByName",
"route53:ListResourceRecordSets",
"route53:ListTagsForResource",
"route53:ListTagsForResources",
"route53:ListVPCAssociationAuthorizations",
"route53domains:GetDomainDetail",
"route53domains:ListDomains",
"s3:GetBucketAcl",
"s3:GetBucketCORS",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketPolicy",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetBucketWebsite",
"s3:GetEncryptionConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetAccountPublicAccessBlock",
"s3:GetBucketPublicAccessBlock",
"s3:ListAllMyBuckets",
"sagemaker:DescribeNotebookInstance",
"sagemaker:ListNotebookInstances",
"sagemaker:ListTags",
"secretsmanager:DescribeSecret",
"secretsmanager:GetResourcePolicy",
"secretsmanager:ListSecrets",
"ses:GetIdentityDkimAttributes",
"ses:GetIdentityMailFromDomainAttributes",
"ses:GetIdentityNotificationAttributes",
"ses:GetIdentityVerificationAttributes",
"ses:ListIdentities",
"ses:ListIdentityPolicies",
"shield:DescribeEmergencyContactSettings",
"shield:ListAttacks",
"shield:ListProtections",
"sns:GetSubscriptionAttributes",
"sns:GetTopicAttributes",
"sns:ListSubscriptions",
"sns:ListTopics",
"sqs:GetQueueAttributes",
"sqs:ListQueueTags",
"sqs:ListQueues",
"sts:GetCallerIdentity",
"support:*",
"tag:GetResources",
"workspaces:DescribeTags",
"workspaces:DescribeWorkspaceBundles",
"workspaces:DescribeWorkspaceDirectories",
"workspaces:DescribeWorkspaces",
"workspaces:DescribeWorkspacesConnectionStatus",
"workmail:Describe*",
"workmail:Get*",
"workmail:List*",
"workmail:Search*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
TRiA Power User Policy¶
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"acm:*",
"apigateway:*",
"autoscaling:*",
"cloudfront:*",
"cloudformation:*",
"cloudsearch:*",
"cloudtrail:*",
"cloudwatch:*",
"config:*",
"dax:*",
"dynamodb:*",
"ec2:*",
"ecr:*",
"ecs:*",
"eks:*",
"elasticache:*",
"elasticfilesystem:*",
"elasticloadbalancing:*",
"elasticmapreduce:*",
"es:*",
"events:*",
"directconnect:*",
"firehose:*",
"fsx:*",
"guardduty:*",
"iam:*",
"kinesis:*",
"kms:*",
"lambda:*",
"logs:*",
"organizations:*",
"rds:*",
"redshift:*",
"route53:*",
"route53domains:*",
"s3:*",
"s3control:*",
"sagemaker:*",
"secretsmanager:*",
"ses:*",
"shield:*",
"sns:*",
"sts:GetCallerIdentity",
"sqs:*",
"support:*",
"tag:*",
"workspaces:*",
"workmail:Describe*",
"workmail:Get*",
"workmail:List*",
"workmail:Search*"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"acm:DescribeCertificate",
"acm:ListCertificates",
"acm:ListTagsForCertificate"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResources",
"cloudformation:DescribeStacks",
"cloudformation:GetTemplate",
"cloudformation:DeleteStack",
"cloudformation:ListStackResources",
"cloudformation:ListStacks"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"pricing:GetProducts"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
To add one of these policies to your account, follow these steps.
Steps¶
1.) AWS Console
Login to the AWS console and access the Identity & Access Management service. This service can be found by clicking on Services at the top left of the console and then clicking on the Identity & Access Management link under Security, Identity & Compliance.
2.) Create Policy
Select Create policy.
3.) Create Policy JSON
Select JSON
4.) Add Policy (Part 1 of 3)
a. Policy Document. Copy and paste your preferred policy in the Policy Document window.
Review Policy. Click Review Policy.
5.) Review Policy (Part 2 of 3)
a. Policy Name. Name your policy something meaningful to you, e.g., TRiA-PowerUser-Policy. (Note, you cannot have spaces in the Policy Name.)
b. Description. Add a policy description that makes it clear whether the policy is Read-only or Power User.
6.) Create Policy (Part 3 of 3)
Click on Create Policy.
7.) Policy is in Place
Now you have the correct policy in place to use when installing an AWS account via API Keys, Instance Assume Role, or Security Token Service (STS).
Finally, if you would like to use Instance Assume Role or STS, both of which use STS, you will need the following policy in addition to your read-only or power-user policy. Give it a name like TRiA-STS-Policy.
STS Policy¶
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Resource": "arn:aws:iam::*:role/*"
},
{
"Action": "sts:GetCallerIdentity",
"Effect": "Allow",
"Resource": "*"
}
]
}
Troubleshooting¶
If you are experiencing difficulties and errors with a policy length, please try using an inline policy which allows for an extended character limit.