Skip to content

Commit 714b459

Browse files
zeroc0d3zeroc0d3
committed
Added role & policies provisioning EMR
1 parent aa7c783 commit 714b459

11 files changed

+892
-0
lines changed

‎bootstrap/devopscorner-role/devops-terraform-emr/amazon-dynamodb-full-access.json‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Action": [
6+
"dynamodb:*",
7+
"dax:*",
8+
"application-autoscaling:DeleteScalingPolicy",
9+
"application-autoscaling:DeregisterScalableTarget",
10+
"application-autoscaling:DescribeScalableTargets",
11+
"application-autoscaling:DescribeScalingActivities",
12+
"application-autoscaling:DescribeScalingPolicies",
13+
"application-autoscaling:PutScalingPolicy",
14+
"application-autoscaling:RegisterScalableTarget",
15+
"cloudwatch:DeleteAlarms",
16+
"cloudwatch:DescribeAlarmHistory",
17+
"cloudwatch:DescribeAlarms",
18+
"cloudwatch:DescribeAlarmsForMetric",
19+
"cloudwatch:GetMetricStatistics",
20+
"cloudwatch:ListMetrics",
21+
"cloudwatch:PutMetricAlarm",
22+
"cloudwatch:GetMetricData",
23+
"datapipeline:ActivatePipeline",
24+
"datapipeline:CreatePipeline",
25+
"datapipeline:DeletePipeline",
26+
"datapipeline:DescribeObjects",
27+
"datapipeline:DescribePipelines",
28+
"datapipeline:GetPipelineDefinition",
29+
"datapipeline:ListPipelines",
30+
"datapipeline:PutPipelineDefinition",
31+
"datapipeline:QueryObjects",
32+
"ec2:DescribeVpcs",
33+
"ec2:DescribeSubnets",
34+
"ec2:DescribeSecurityGroups",
35+
"iam:GetRole",
36+
"iam:ListRoles",
37+
"kms:DescribeKey",
38+
"kms:ListAliases",
39+
"sns:CreateTopic",
40+
"sns:DeleteTopic",
41+
"sns:ListSubscriptions",
42+
"sns:ListSubscriptionsByTopic",
43+
"sns:ListTopics",
44+
"sns:Subscribe",
45+
"sns:Unsubscribe",
46+
"sns:SetTopicAttributes",
47+
"lambda:CreateFunction",
48+
"lambda:ListFunctions",
49+
"lambda:ListEventSourceMappings",
50+
"lambda:CreateEventSourceMapping",
51+
"lambda:DeleteEventSourceMapping",
52+
"lambda:GetFunctionConfiguration",
53+
"lambda:DeleteFunction",
54+
"resource-groups:ListGroups",
55+
"resource-groups:ListGroupResources",
56+
"resource-groups:GetGroup",
57+
"resource-groups:GetGroupQuery",
58+
"resource-groups:DeleteGroup",
59+
"resource-groups:CreateGroup",
60+
"tag:GetResources",
61+
"kinesis:ListStreams",
62+
"kinesis:DescribeStream",
63+
"kinesis:DescribeStreamSummary"
64+
],
65+
"Effect": "Allow",
66+
"Resource": "*"
67+
},
68+
{
69+
"Action": "cloudwatch:GetInsightRuleReport",
70+
"Effect": "Allow",
71+
"Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*"
72+
},
73+
{
74+
"Action": [
75+
"iam:PassRole"
76+
],
77+
"Effect": "Allow",
78+
"Resource": "*",
79+
"Condition": {
80+
"StringLike": {
81+
"iam:PassedToService": [
82+
"application-autoscaling.amazonaws.com",
83+
"application-autoscaling.amazonaws.com.cn",
84+
"dax.amazonaws.com"
85+
]
86+
}
87+
}
88+
},
89+
{
90+
"Effect": "Allow",
91+
"Action": [
92+
"iam:CreateServiceLinkedRole"
93+
],
94+
"Resource": "*",
95+
"Condition": {
96+
"StringEquals": {
97+
"iam:AWSServiceName": [
98+
"replication.dynamodb.amazonaws.com",
99+
"dax.amazonaws.com",
100+
"dynamodb.application-autoscaling.amazonaws.com",
101+
"contributorinsights.dynamodb.amazonaws.com",
102+
"kinesisreplication.dynamodb.amazonaws.com"
103+
]
104+
}
105+
}
106+
}
107+
]
108+
}

‎bootstrap/devopscorner-role/devops-terraform-emr/amazon-ec2-full-access.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Action": "ec2:*",
6+
"Effect": "Allow",
7+
"Resource": "*"
8+
},
9+
{
10+
"Effect": "Allow",
11+
"Action": "elasticloadbalancing:*",
12+
"Resource": "*"
13+
},
14+
{
15+
"Effect": "Allow",
16+
"Action": "cloudwatch:*",
17+
"Resource": "*"
18+
},
19+
{
20+
"Effect": "Allow",
21+
"Action": "autoscaling:*",
22+
"Resource": "*"
23+
},
24+
{
25+
"Effect": "Allow",
26+
"Action": "iam:CreateServiceLinkedRole",
27+
"Resource": "*",
28+
"Condition": {
29+
"StringEquals": {
30+
"iam:AWSServiceName": [
31+
"autoscaling.amazonaws.com",
32+
"ec2scheduled.amazonaws.com",
33+
"elasticloadbalancing.amazonaws.com",
34+
"spot.amazonaws.com",
35+
"spotfleet.amazonaws.com",
36+
"transitgateway.amazonaws.com"
37+
]
38+
}
39+
}
40+
}
41+
]
42+
}

‎bootstrap/devopscorner-role/devops-terraform-emr/amazon-emr-full-access.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Action": [
6+
"cloudwatch:*",
7+
"cloudformation:CreateStack",
8+
"cloudformation:DescribeStackEvents",
9+
"ec2:AuthorizeSecurityGroupIngress",
10+
"ec2:AuthorizeSecurityGroupEgress",
11+
"ec2:CancelSpotInstanceRequests",
12+
"ec2:CreateRoute",
13+
"ec2:CreateSecurityGroup",
14+
"ec2:CreateTags",
15+
"ec2:DeleteRoute",
16+
"ec2:DeleteTags",
17+
"ec2:DeleteSecurityGroup",
18+
"ec2:DescribeAvailabilityZones",
19+
"ec2:DescribeAccountAttributes",
20+
"ec2:DescribeInstances",
21+
"ec2:DescribeKeyPairs",
22+
"ec2:DescribeRouteTables",
23+
"ec2:DescribeSecurityGroups",
24+
"ec2:DescribeSpotInstanceRequests",
25+
"ec2:DescribeSpotPriceHistory",
26+
"ec2:DescribeSubnets",
27+
"ec2:DescribeVpcAttribute",
28+
"ec2:DescribeVpcs",
29+
"ec2:DescribeRouteTables",
30+
"ec2:DescribeNetworkAcls",
31+
"ec2:CreateVpcEndpoint",
32+
"ec2:ModifyImageAttribute",
33+
"ec2:ModifyInstanceAttribute",
34+
"ec2:RequestSpotInstances",
35+
"ec2:RevokeSecurityGroupEgress",
36+
"ec2:RunInstances",
37+
"ec2:TerminateInstances",
38+
"elasticmapreduce:*",
39+
"iam:GetPolicy",
40+
"iam:GetPolicyVersion",
41+
"iam:ListRoles",
42+
"iam:PassRole",
43+
"kms:List*",
44+
"s3:*",
45+
"sdb:*"
46+
],
47+
"Effect": "Allow",
48+
"Resource": "*"
49+
},
50+
{
51+
"Effect": "Allow",
52+
"Action": "iam:CreateServiceLinkedRole",
53+
"Resource": "*",
54+
"Condition": {
55+
"StringLike": {
56+
"iam:AWSServiceName": [
57+
"elasticmapreduce.amazonaws.com",
58+
"elasticmapreduce.amazonaws.com.cn"
59+
]
60+
}
61+
}
62+
}
63+
]
64+
}

‎bootstrap/devopscorner-role/devops-terraform-emr/amazon-route53-full-access.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"route53:*",
8+
"route53domains:*",
9+
"cloudfront:ListDistributions",
10+
"elasticloadbalancing:DescribeLoadBalancers",
11+
"elasticbeanstalk:DescribeEnvironments",
12+
"s3:ListBucket",
13+
"s3:GetBucketLocation",
14+
"s3:GetBucketWebsite",
15+
"ec2:DescribeVpcs",
16+
"ec2:DescribeVpcEndpoints",
17+
"ec2:DescribeRegions",
18+
"sns:ListTopics",
19+
"sns:ListSubscriptionsByTopic",
20+
"cloudwatch:DescribeAlarms",
21+
"cloudwatch:GetMetricStatistics"
22+
],
23+
"Resource": "*"
24+
},
25+
{
26+
"Effect": "Allow",
27+
"Action": "apigateway:GET",
28+
"Resource": "arn:aws:apigateway:*::/domainnames"
29+
}
30+
]
31+
}

‎bootstrap/devopscorner-role/devops-terraform-emr/amazon-s3-full-access.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"s3:*",
8+
"s3-object-lambda:*"
9+
],
10+
"Resource": "*"
11+
}
12+
]
13+
}

‎bootstrap/devopscorner-role/devops-terraform-emr/cloudwatch-ddb-access.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "VisualEditor0",
6+
"Effect": "Allow",
7+
"Action": [
8+
"logs:*",
9+
"dynamodb:DescribeContributorInsights",
10+
"dynamodb:RestoreTableToPointInTime",
11+
"dynamodb:UpdateGlobalTable",
12+
"dynamodb:UpdateTableReplicaAutoScaling",
13+
"dynamodb:DescribeTable",
14+
"dynamodb:PartiQLInsert",
15+
"dynamodb:GetItem",
16+
"dynamodb:DescribeContinuousBackups",
17+
"dynamodb:DescribeExport",
18+
"events:*",
19+
"dynamodb:EnableKinesisStreamingDestination",
20+
"dynamodb:BatchGetItem",
21+
"dynamodb:DisableKinesisStreamingDestination",
22+
"dynamodb:UpdateTimeToLive",
23+
"dynamodb:BatchWriteItem",
24+
"dynamodb:PutItem",
25+
"dynamodb:PartiQLUpdate",
26+
"dynamodb:Scan",
27+
"dynamodb:UpdateItem",
28+
"dynamodb:UpdateGlobalTableSettings",
29+
"dynamodb:CreateTable",
30+
"cloudwatch:*",
31+
"dynamodb:GetShardIterator",
32+
"dynamodb:DescribeReservedCapacity",
33+
"dynamodb:ExportTableToPointInTime",
34+
"dynamodb:DescribeBackup",
35+
"dynamodb:UpdateTable",
36+
"dynamodb:GetRecords",
37+
"dynamodb:DescribeTableReplicaAutoScaling",
38+
"dynamodb:ListTables",
39+
"dynamodb:DeleteItem",
40+
"dynamodb:PurchaseReservedCapacityOfferings",
41+
"dynamodb:CreateTableReplica",
42+
"dynamodb:ListTagsOfResource",
43+
"dynamodb:UpdateContributorInsights",
44+
"dynamodb:CreateBackup",
45+
"dynamodb:UpdateContinuousBackups",
46+
"dynamodb:DescribeReservedCapacityOfferings",
47+
"dynamodb:TagResource",
48+
"dynamodb:PartiQLSelect",
49+
"dynamodb:CreateGlobalTable",
50+
"dynamodb:DescribeKinesisStreamingDestination",
51+
"dynamodb:DescribeLimits",
52+
"dynamodb:ListExports",
53+
"dynamodb:UntagResource",
54+
"dynamodb:ConditionCheckItem",
55+
"dynamodb:ListBackups",
56+
"dynamodb:Query",
57+
"dynamodb:DescribeStream",
58+
"dynamodb:DescribeTimeToLive",
59+
"dynamodb:ListStreams",
60+
"dynamodb:ListContributorInsights",
61+
"dynamodb:DescribeGlobalTableSettings",
62+
"dynamodb:ListGlobalTables",
63+
"dynamodb:DescribeGlobalTable",
64+
"dynamodb:RestoreTableFromBackup",
65+
"dynamodb:DeleteBackup",
66+
"dynamodb:PartiQLDelete"
67+
],
68+
"Resource": "*"
69+
}
70+
]
71+
}

‎bootstrap/devopscorner-role/devops-terraform-emr/resource-group-tags-editor.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"tag:getResources",
8+
"tag:getTagKeys",
9+
"tag:getTagValues",
10+
"tag:TagResources",
11+
"tag:UntagResources",
12+
"resource-groups:*",
13+
"cloudformation:DescribeStacks",
14+
"cloudformation:ListStackResources"
15+
],
16+
"Resource": "*"
17+
}
18+
]
19+
}

0 commit comments

Comments
 (0)