I was trying to lock down user account just to Amazon Connect, Lambda and S3. I was able to give permissions to S3 and Lambda but I cannot find permissions for Amazon Connect. I have went through the documentation etc. but I cannot find out the proper name of that service so I will be able to write a policy for it. Would you be able to help?
1 Answer
There's a generator for policies in IAM (Into IAM -> Policies -> Create), choosing connect gives me the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"connect:DescribeInstance",
"connect:CreateInstance",
"connect:ModifyInstance",
"connect:ListInstances",
"connect:GetFederationTokens",
"connect:DestroyInstance",
"connect:GetFederationToken"
],
"Resource": "*"
}
]
}
There's a warning on the action part saying:
- connect:DescribeInstance action requires 7 more actions to provide full permissions
- connect:CreateInstance action requires 13 more actions to provide full permissions
- connect:ModifyInstance action requires 10 more actions to provide full permissions
Each of them says:
To allow an entity to call 'DescribeInstance', grant all of the following required permissions.
- firehose:DescribeDeliveryStream
- firehose:ListDeliveryStreams
- kinesis:DescribeStream
- kinesis:ListStreams
- kms:DescribeKey
- kms:ListAliases
- s3:ListAllMyBuckets
To allow an entity to call 'CreateInstance', grant all of the following required permissions.
- ds:CreateAlias
- ds:DeleteDirectory
- ds:DescribeDirectories
- firehose:DescribeDeliveryStream
- firehose:ListDeliveryStreams
- kinesis:DescribeStream
- kinesis:ListStreams
- kms:CreateGrant
- kms:DescribeKey
- kms:ListAliases
- kms:RetireGrant
- s3:CreateBucket
- s3:ListAllMyBuckets
To allow an entity to call 'ModifyInstance', grant all of the following required permissions.
- firehose:DescribeDeliveryStream
- firehose:ListDeliveryStreams
- kinesis:DescribeStream
- kinesis:ListStreams
- kms:CreateGrant
- kms:DescribeKey
- kms:ListAliases
- kms:RetireGrant
- s3:CreateBucket
- s3:ListAllMyBuckets
Which once compiled gives the following policy when not filtering on any resource:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"connect:DescribeInstance",
"connect:ModifyInstance",
"connect:GetFederationTokens",
"s3:CreateBucket",
"kinesis:DescribeStream",
"kms:RetireGrant",
"connect:DestroyInstance",
"firehose:DescribeDeliveryStream",
"kinesis:ListStreams",
"connect:CreateInstance",
"s3:ListAllMyBuckets",
"connect:ListInstances",
"kms:ListAliases",
"ds:DescribeDirectories",
"kms:DescribeKey",
"firehose:ListDeliveryStreams",
"ds:CreateAlias",
"kms:CreateGrant",
"connect:GetFederationToken",
"ds:DeleteDirectory"
],
"Resource": "*"
}
]
}
