Skip to content

Instantly share code, notes, and snippets.

@daharon

daharon/bucket-policy.yaml

Last active December 4, 2017 15:08
Show Gist options
  • Save daharon/bbf7db8364b8e3381f436b9deddad711 to your computer and use it in GitHub Desktop.
Save daharon/bbf7db8364b8e3381f436b9deddad711 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
bucket-policy.yaml
ExampleS3BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref ExampleS3Bucket
PolicyDocument:
Id: AllowExternalAccountAccess
Version: '2012-10-17'
Statement:
- Action:
- s3:GetObject
Effect: Allow
Resource:
- arn:aws:s3:::example-bucket/*
Principal:
AWS:
- 123456789101
- 123456789102
- Action:
- s3:GetBucketLocation
- s3:ListBucket
Effect: Allow
Resource:
- arn:aws:s3:::example-bucket
Principal:
AWS:
- 123456789101
- 123456789102
Raw
external-account-iam-role.yaml
baseRole:
Type: AWS::IAM::Role
Properties:
RoleName: base
Path: '/ec2/'
ManagedPolicyArns:
- arn:aws:iam::<%= account %>:policy/example/ExampleKey
- arn:aws:iam::<%= account %>:policy/example/ExampleDefault
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
baseInstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
InstanceProfileName: base
Path: '/ec2/'
Roles:
- Ref: 'baseRole'
ExampleDefault:
Type: AWS::IAM::ManagedPolicy
Properties:
ManagedPolicyName: ExampleDefault
Description: 'Default Example S3 data bag access.'
Path: '/example/'
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- s3:ListBucket
Resource:
- arn:aws:s3:::example-bucket/dev/general
- arn:aws:s3:::example-bucket/staging/general
- arn:aws:s3:::example-bucket/ops/general
- arn:aws:s3:::example-bucket/production/general
- Effect: Allow
Action:
- s3:GetObject
Resource:
- arn:aws:s3:::example-bucket/dev/general/*
- arn:aws:s3:::example-bucket/staging/general/*
- arn:aws:s3:::example-bucket/ops/general/*
- arn:aws:s3:::example-bucket/production/general/*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment