-2

I was trying to lock down user account just to Amazon Connect, Lambda and S3. I was able to give permissions to S3 and Lambda but I cannot find permissions for Amazon Connect. I have went through the documentation etc. but I cannot find out the proper name of that service so I will be able to write a policy for it. Would you be able to help?

3

There's a generator for policies in IAM (Into IAM -> Policies -> Create), choosing connect gives me the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "connect:DescribeInstance",
                "connect:CreateInstance",
                "connect:ModifyInstance",
                "connect:ListInstances",
                "connect:GetFederationTokens",
                "connect:DestroyInstance",
                "connect:GetFederationToken"
            ],
            "Resource": "*"
        }
    ]
}

There's a warning on the action part saying:

  • connect:DescribeInstance action requires 7 more actions to provide full permissions
  • connect:CreateInstance action requires 13 more actions to provide full permissions
  • connect:ModifyInstance action requires 10 more actions to provide full permissions

Each of them says:

To allow an entity to call 'DescribeInstance', grant all of the following required permissions.

  • firehose:DescribeDeliveryStream
  • firehose:ListDeliveryStreams
  • kinesis:DescribeStream
  • kinesis:ListStreams
  • kms:DescribeKey
  • kms:ListAliases
  • s3:ListAllMyBuckets

To allow an entity to call 'CreateInstance', grant all of the following required permissions.

  • ds:CreateAlias
  • ds:DeleteDirectory
  • ds:DescribeDirectories
  • firehose:DescribeDeliveryStream
  • firehose:ListDeliveryStreams
  • kinesis:DescribeStream
  • kinesis:ListStreams
  • kms:CreateGrant
  • kms:DescribeKey
  • kms:ListAliases
  • kms:RetireGrant
  • s3:CreateBucket
  • s3:ListAllMyBuckets

To allow an entity to call 'ModifyInstance', grant all of the following required permissions.

  • firehose:DescribeDeliveryStream
  • firehose:ListDeliveryStreams
  • kinesis:DescribeStream
  • kinesis:ListStreams
  • kms:CreateGrant
  • kms:DescribeKey
  • kms:ListAliases
  • kms:RetireGrant
  • s3:CreateBucket
  • s3:ListAllMyBuckets

Which once compiled gives the following policy when not filtering on any resource:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "connect:DescribeInstance",
                "connect:ModifyInstance",
                "connect:GetFederationTokens",
                "s3:CreateBucket",
                "kinesis:DescribeStream",
                "kms:RetireGrant",
                "connect:DestroyInstance",
                "firehose:DescribeDeliveryStream",
                "kinesis:ListStreams",
                "connect:CreateInstance",
                "s3:ListAllMyBuckets",
                "connect:ListInstances",
                "kms:ListAliases",
                "ds:DescribeDirectories",
                "kms:DescribeKey",
                "firehose:ListDeliveryStreams",
                "ds:CreateAlias",
                "kms:CreateGrant",
                "connect:GetFederationToken",
                "ds:DeleteDirectory"
            ],
            "Resource": "*"
        }
    ]
}
  • Thanks for the answer. I don't know how I have missed this. – mrktos Mar 21 '18 at 13:09
  • Be sure to accept the answer, @mrktos – Rilindo Mar 26 '18 at 0:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.