创建仅限CloudFormation的AWS策略

Question

我想在AWS中创建一个策略和角色，只允许通过CloudFormation而不是通过控制台创建资源。实现这一目标的最佳方法是什么？

Answer 1

实现您希望实现的目标的最简单方法是创建CloudFormation服务角色，并授予您的用户将此角色传递给CloudFormation，以及执行CloudFormation创建，更新等的能力。

我创建了一个CloudFormation模板，其中包含起点角色和具有策略的组，这些策略应该可以满足您的需求。

• CloudFormationServiceRole：CloudFormation使用的实际角色，具有在AWS中执行操作的权限
• UsersGroup：该集团将您的用户添加到。它有权在CloudFormation中执行操作并传递CloudFormationServiceRole，而不是其他任何内容。

---

AWSTemplateFormatVersion: 2010-09-09
Resources:
  CloudFormationServiceRole:
    # This Role will actually do all of the heavy lifting and resouce
    # creation
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        -
          PolicyName: CloudformationAccess
          PolicyDocument:
            # This policy defines what the users can actually do
            # With Cloudformation
            Version: 2012-10-17
            Statement:
              - 
                Effect: Allow
                Action: "*"
                Resource: "*"
  UsersGroup:
    # The users will use the role, but do nothing themselves
    Type: AWS::IAM::Group
    Properties:
      Policies:
        -
          PolicyName: UsersCloudformationAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - 
                Effect: Allow
                Action:
                  - cloudformation:*
                Resource: "*"
              -
                Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:PassRole
                Resource: !GetAtt CloudFormationServiceRole.Arn