Skip to content

Commit 596d063

Browse files
AdarBaharAdarBahar
authored
Update aws-console.md
updated JSON files - per new versions specified on https://redislabs.atlassian.net/wiki/spaces/RED/pages/5027266697/Reduced+external+accounts+AWS+IAM+policies (JSON last update: May 9th, 2025)
1 parent 4b1ff1c commit 596d063

File tree

1 file changed

+73
-49
lines changed
  • content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources

1 file changed

+73
-49
lines changed

‎content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/aws-console.md

Lines changed: 73 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
2626

2727
{{< expand "View RedisLabsInstanceRolePolicy.json" >}}
2828
```js
29-
{
29+
{
3030
"Version": "2012-10-17",
3131
"Statement": [
3232
{
@@ -84,19 +84,19 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
8484
]
8585
},
8686
{
87-
"Sid": "TagResourcesDelete",
88-
"Effect": "Allow",
89-
"Action": [
87+
"Sid": "TagResourcesDelete",
88+
"Effect": "Allow",
89+
"Action": [
9090
"ec2:DeleteTags"
91-
],
92-
"Resource": [
91+
],
92+
"Resource": [
9393
"*"
94-
],
95-
"Condition": {
96-
"StringEquals": {
97-
"ec2:ResourceTag/RedisLabsIdentifier": "Redislabs-VPC"
98-
}
99-
}
94+
],
95+
"Condition": {
96+
"StringEquals": {
97+
"ec2:ResourceTag/RedisLabsIdentifier": "Redislabs-VPC"
98+
}
99+
}
100100
}
101101
]
102102
}
@@ -152,7 +152,11 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
152152
"ec2:DescribeInternetGateways",
153153
"ec2:DescribeImages",
154154
"ec2:DescribeTransitGatewayVpcAttachments",
155-
"ec2:DescribeVpcPeeringConnections"
155+
"ec2:DescribeVpcPeeringConnections",
156+
"ec2:DescribeKeyPairs",
157+
"ec2:DescribeTransitGateways",
158+
"ec2:DescribeInstanceStatus",
159+
"ec2:DescribeNetworkAcls"
156160
],
157161
"Resource": "*"
158162
},
@@ -164,12 +168,7 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
164168
"cloudwatch:Get*",
165169
"cloudwatch:List*"
166170
],
167-
"Resource": "*",
168-
"Condition": {
169-
"StringEquals": {
170-
"ec2:ResourceTag/RedisLabsIdentifier": "Redislabs-VPC"
171-
}
172-
}
171+
"Resource": "*"
173172
},
174173
{
175174
"Sid": "IamUserOperations",
@@ -182,27 +181,26 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
182181
"Resource": "arn:aws:iam::*:user/${aws:username}"
183182
},
184183
{
185-
"Sid": "PassRlClusterNodeRole",
186-
"Effect": "Allow",
187-
"Action": "iam:PassRole",
188-
"Resource": "arn:aws:iam::*:role/redislabs-cluster-node-role"
189-
},
190-
{
191-
"Sid": "IAMRoleReadAccess",
192-
"Effect": "Allow",
184+
"Sid": "RolePolicyUserReadActions",
193185
"Action": [
194186
"iam:GetRole",
195187
"iam:GetPolicy",
188+
"iam:ListUsers",
189+
"iam:ListPolicies",
196190
"iam:ListRolePolicies",
197191
"iam:ListAttachedRolePolicies",
198192
"iam:ListInstanceProfiles",
199193
"iam:ListInstanceProfilesForRole",
200194
"iam:SimulatePrincipalPolicy"
201195
],
202-
"Resource": [
203-
"arn:aws:iam::*:role/Redislabs-*",
204-
"arn:aws:iam::*:policy/Redislabs-*"
205-
]
196+
"Effect": "Allow",
197+
"Resource": "*"
198+
},
199+
{
200+
"Sid": "PassRlClusterNodeRole",
201+
"Effect": "Allow",
202+
"Action": "iam:PassRole",
203+
"Resource": "arn:aws:iam::*:role/redislabs-cluster-node-role"
206204
},
207205
{
208206
"Sid": "CreateEc2ResourcesWithoutTag",
@@ -216,7 +214,13 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
216214
"ec2:CreateSecurityGroup",
217215
"ec2:CreateInternetGateway",
218216
"ec2:CreateRouteTable",
219-
"ec2:CreateSubnet"
217+
"ec2:CreateSubnet",
218+
"ec2:CreateSnapshot",
219+
"ec2:CreateTransitGateway",
220+
"ec2:AssociateVpcCidrBlock",
221+
"ec2:CreateTransitGatewayVpcAttachment",
222+
"ec2:AttachInternetGateway",
223+
"ec2:ReplaceRoute"
220224
],
221225
"Resource": "*"
222226
},
@@ -238,19 +242,6 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
238242
}
239243
}
240244
},
241-
{
242-
"Sid": "DenyCreateVpcWithoutRequiredTag",
243-
"Effect": "Deny",
244-
"Action": [
245-
"ec2:CreateVpc"
246-
],
247-
"Resource": "*",
248-
"Condition": {
249-
"Null": {
250-
"aws:RequestTag/RedisLabsIdentifier": "true"
251-
}
252-
}
253-
},
254245
{
255246
"Sid": "AllowVpcPeeringManagement",
256247
"Effect": "Allow",
@@ -278,9 +269,6 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
278269
"Effect": "Allow",
279270
"Action": [
280271
"ec2:CreateVolume",
281-
"ec2:CreateSnapshot",
282-
"ec2:ImportKeyPair",
283-
"ec2:AttachInternetGateway",
284272
"ec2:CreateRoute",
285273
"ec2:AuthorizeSecurityGroupIngress",
286274
"ec2:AuthorizeSecurityGroupEgress"
@@ -325,7 +313,6 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
325313
"ec2:DeleteSecurityGroup",
326314
"ec2:DeleteRouteTable",
327315
"ec2:DeleteRoute",
328-
"ec2:DetachInternetGateway",
329316
"ec2:DeleteInternetGateway",
330317
"ec2:DeleteVpc"
331318
],
@@ -336,6 +323,18 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
336323
}
337324
}
338325
},
326+
{
327+
"Sid": "DeleteEc2ResourcesWithoutTag",
328+
"Effect": "Allow",
329+
"Action": [
330+
"ec2:RevokeSecurityGroupIngress",
331+
"ec2:RejectVpcPeeringConnection",
332+
"ec2:DeleteTransitGatewayVpcAttachment",
333+
"ec2:DeleteTransitGateway",
334+
"ec2:DetachInternetGateway"
335+
],
336+
"Resource": "*"
337+
},
339338
{
340339
"Sid": "CreateAndChangeServiceLinkedRoleForTransitGateway",
341340
"Effect": "Allow",
@@ -348,12 +347,37 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
348347
}
349348
},
350349
{
350+
"Sid": "RolePolicyForTransitGateway",
351351
"Effect": "Allow",
352352
"Action": [
353353
"iam:AttachRolePolicy",
354354
"iam:PutRolePolicy"
355355
],
356356
"Resource": "arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway*"
357+
},
358+
{
359+
"Sid": "AllowEncryptedVolumeCreation",
360+
"Effect": "Allow",
361+
"Action": [
362+
"kms:GenerateDataKeyWithoutPlaintext",
363+
"kms:DescribeKey"
364+
],
365+
"Resource": "*"
366+
},
367+
{
368+
"Sid": "AllowAttachDetachOfEncryptedVolumes",
369+
"Effect": "Allow",
370+
"Action": [
371+
"kms:CreateGrant",
372+
"kms:ListGrants",
373+
"kms:RevokeGrant"
374+
],
375+
"Resource": "*",
376+
"Condition": {
377+
"Bool": {
378+
"kms:GrantIsForAWSResource": "true"
379+
}
380+
}
357381
}
358382
]
359383
}

0 commit comments

Comments
 (0)