Repository navigation
Document least-privilege IAM permissions and bucket creation #81
Description
It would be useful to have documentation about running Sceptre in a least-privilege environment in the Getting Started guide. Specifically, it would be useful to explain:
- a bucket will be automatically created, or that you can specify one which you have created
- the least-privilege IAM permissions for a specified bucket
- any other least-privilege IAM permissions needed to run Sceptre (probably just Cloudformation)
Working on this earlier, this should be a start towards the IAM permissions, but cloudformation:* may be excessive:
PolicyDocument:
Version: 2012-10-17
Statement:
-
Effect: Allow
Resource: "*"
Action:
- cloudformation:*
-
Effect: Allow
Resource: <bucket>/*
Action:
- s3:PutObject
- s3:GetObject
-
Effect: Allow
Resource: <bucket>
Action:
- s3:ListBucket
Activity
theseanything commentedon Mar 19, 2017
Thanks @rdkr! This is a good idea. As I see it there are 3 sets of permissions -
Permissions for S3 bucket access for those using S3 store templates (as you can use sceptre to upload the template directly in the Cloudformation api call)
Permissions for CloudFormation that allows all of the Sceptre commands to be run.
Permissions for the underlying template - depends on what resources are in the template and what action CloudFormation is taking.
The first two sets are something we can definitely outline in our docs. And agreed lets try to avoid using wildcard :)
jamesroutley commentedon May 12, 2017
@rdkr you happy to work on this?
trenigma commentedon May 29, 2018
@rdkr @theseanything @jamesroutley Hi all, as a newb to Sceptre and in the process of learning it, I'd like to see if I could contribute to the project starting with this issue.. any objections? I think since it involves documentation it could potentially dovetail nicely with my efforts to learn the tool.
rdkr commentedon Jun 3, 2018
Hey @trenigma, sorry for the delayed reply. No objections here!
craighurley commentedon May 3, 2021
@trenigma do you still use sceptre? Are you willing to contribute a PR to address the documentation update?
zaro0508 commentedon Feb 5, 2022
Transition this to a a GH discussion because @jfalkenstein just added some general docs around setting up IAM with Sceptre. We also don't want to prescribe anything too specific otherwise it will create a maintenance burden.