forked from 100daysofdevops/100daysofdevops
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ec2-t2-instance-restriction.tf
168 lines (164 loc) · 6.63 KB
/
ec2-t2-instance-restriction.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
provider "aws" {
region = "us-west-2"
}
resource "aws_iam_user" "my-user" {
name = "my-test-user"
}
resource "aws_iam_policy" "t2-instance-restricition-policy" {
name = "t2-instance-restricition-policy"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:GetConsoleScreenshot"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:key-pair/*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*::snapshot/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:placement-group/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*::image/*"
],
"Condition": {
"StringLike": {
"ec2:InstanceType": "t2.*"
}
}
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteSecurityGroup"
],
"Resource": "arn:aws:ec2:*:*:security-group/*"
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:CreateKeyPair",
"ec2:DescribeSnapshots",
"ec2:DescribeHostReservationOfferings",
"ec2:DescribeVolumeStatus",
"ec2:DescribeScheduledInstanceAvailability",
"ec2:DescribeVolumes",
"ec2:DescribeFpgaImageAttribute",
"ec2:DescribeExportTasks",
"ec2:DescribeKeyPairs",
"ec2:DescribeReservedInstancesListings",
"ec2:DescribeCapacityReservations",
"ec2:DescribeSpotFleetRequestHistory",
"ec2:DescribeVpcClassicLinkDnsSupport",
"ec2:DescribeSnapshotAttribute",
"ec2:DescribeIdFormat",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeImportSnapshotTasks",
"ec2:GetPasswordData",
"ec2:DescribeVpcEndpointServicePermissions",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeScheduledInstances",
"ec2:DescribeImageAttribute",
"ec2:DescribeFleets",
"ec2:DescribeReservedInstancesModifications",
"ec2:DescribeSubnets",
"ec2:DescribeMovingAddresses",
"ec2:DescribeFleetHistory",
"ec2:DescribePrincipalIdFormat",
"ec2:DescribeFlowLogs",
"ec2:DescribeRegions",
"ec2:DescribeTransitGateways",
"ec2:DescribeVpcEndpointServices",
"ec2:DescribeSpotInstanceRequests",
"ec2:DescribeVpcAttribute",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeVpcEndpointConnections",
"ec2:DescribeInstanceStatus",
"ec2:DescribeHostReservations",
"ec2:DescribeBundleTasks",
"ec2:DescribeIdentityIdFormat",
"ec2:DescribeClassicLinkInstances",
"ec2:DescribeVpcEndpointConnectionNotifications",
"ec2:DescribeSecurityGroups",
"ec2:DescribeFpgaImages",
"ec2:DescribeVpcs",
"ec2:DescribeStaleSecurityGroups",
"ec2:DescribeAggregateIdFormat",
"ec2:DescribeVolumesModifications",
"ec2:GetHostReservationPurchasePreview",
"ec2:DescribeByoipCidrs",
"ec2:DescribePlacementGroups",
"ec2:DescribeInternetGateways",
"ec2:SearchTransitGatewayRoutes",
"ec2:GetLaunchTemplateData",
"ec2:DescribeSpotDatafeedSubscription",
"ec2:DescribeAccountAttributes",
"ec2:DescribeNetworkInterfacePermissions",
"ec2:DescribeReservedInstances",
"ec2:DescribeNetworkAcls",
"ec2:DescribeRouteTables",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeReservedInstancesOfferings",
"ec2:GetTransitGatewayAttachmentPropagations",
"ec2:DescribeFleetInstances",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribePrefixLists",
"ec2:GetReservedInstancesExchangeQuote",
"ec2:DescribeInstanceCreditSpecifications",
"ec2:DescribeVpcClassicLink",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeElasticGpus",
"ec2:DeleteKeyPair",
"ec2:DescribeVpnGateways",
"ec2:DescribeAddresses",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeDhcpOptions",
"ec2:GetConsoleOutput",
"ec2:DescribeSpotPriceHistory",
"ec2:DescribeNetworkInterfaces",
"ec2:CreateSecurityGroup",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeTags",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeImportImageTasks",
"ec2:DescribeNatGateways",
"ec2:DescribeCustomerGateways",
"ec2:DescribeSpotFleetRequests",
"ec2:DescribeHosts",
"ec2:DescribeImages",
"ec2:DescribeSpotFleetInstances",
"ec2:DescribeSecurityGroupReferences",
"ec2:DescribePublicIpv4Pools",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeConversionTasks"
],
"Resource": "*"
}
]
}
EOF
}
resource "aws_iam_user_policy_attachment" "attach-policy" {
policy_arn = "${aws_iam_policy.t2-instance-restricition-policy.arn}"
user = "${aws_iam_user.my-user.name}"
}