Tuesday, August 18, 2020

CloudFormation Template for IAM Role with Inline Poicy

I struggled with this a bit to create a cloudformation template for IAM role with inline policy with IAM user as principal. So here it is as a quick reference:


    AWSTemplateFormatVersion: 2010-09-09
    Parameters:
      vTableName:
        Type: String
        Description: the tablename
        Default: arn:aws:dynamodb:ap-southeast-2:1234567:table/test-table
      vUserName:
        Type: String
        Description: New account username
        Default: mytestuser
    Resources:
      DynamoRoleForTest:
        Type: 'AWS::IAM::Role'
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Effect: Allow
              Principal:
                AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${vUserName}'  
              Action:
              - sts:AssumeRole    
          Path: /
          Policies:
            - PolicyName: DynamoPolicy
              PolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Effect: Allow
                    Action:
                      - dynamodb:BatchGet*
                      - dynamodb:DescribeStream
                      - dynamodb:DescribeTable
                      - dynamodb:Get*
                      - dynamodb:Query
                      - dynamodb:Scan                                    
                    Resource: !Ref vTableName
I hope that helps. Thanks.

No comments: