2

I need to create a CloudFormation SAM template that creates multiple resources. I also need to integrate GitHub Actions so code gets auto deployed on push. The problem is this requires that I give GitHub a lot of IAM permissions to do the necessary work. Note that I'm using an Open ID identity provider for GitHub as opposed to api keys.

How do I find out which IAM permissions are needed at minimum so I don't give GitHub more than what is necessary? Is there an AWS tool that can parse the deployment template and tell me which permissions are needed for both deployments and rollbacks?

1 Answer 1

3

No, there's no such tool. You can however look at the Cloudtrail logs to see which actions are being invoked by CloudFormation, and based on that you could put together the list of required policies.

Alternatively, you could replicate what the CloudFormation template is doing by using the AWS CLI. That way, you could use iamlive to generate the IAM policies required for those CLI commands.

3
  • 1
    iamlive looks pretty cool. I don't mind using this, but how do I convert the CF template (with declarative syntax) to CLI commands?
    – user246392
    Sep 17, 2022 at 17:19
  • 1
    @user246392 you'll have to go through each resource in the template one by one and you'll have to try and create each resource with the required CLI command (use --dry-run to mock the creation)
    – Paolo
    Sep 17, 2022 at 17:30
  • Cloudtrail isn't free. So basically I need to pay $2.5/month JUST to know which permissions the user needs? lol, they do find a way to charge you for everything on AWS
    – Bersan
    Feb 5 at 12:53

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.