Add an IAM policy for the Hydra provisioner
Unfortunately IAM doesn't allow specifying that a user should only be allowed to destroy (spot) instances that it created itself. So instead we restrict it to us-east-1, which is good enough since we don't have anything else running there.
Eelco Dolstra committed
Sep 4, 2017 at 18:00 UTC
649f6002a0de1388d2b24041688e2a49473f9954
1 file changed
+39
hydra-provisioner/policy.json
new
+39
@@ -0,0 +1,39 @@
1
+{
2
+ "Version": "2012-10-17",
3
+ "Statement": [
4
+ {
5
+ "Sid": "NoResource",
6
+ "Effect": "Allow",
7
+ "Action": [
8
+ "ec2:DescribeKeyPairs",
9
+ "ec2:ImportKeyPair",
10
+ "ec2:DeleteKeyPair",
11
+ "ec2:DescribeInstances",
12
+ "ec2:DescribeSpotInstanceRequests",
13
+ "ec2:DescribeImages",
14
+ "ec2:DescribeInstanceStatus",
15
+ "ec2:RequestSpotInstances",
16
+ "ec2:CancelSpotInstanceRequests"
17
+ ],
18
+ "Resource": [
19
+ "*"
20
+ ],
21
+ "Condition": {
22
+ "StringEquals": {
23
+ "ec2:Region": "us-east-1"
24
+ }
25
+ }
26
+ },
27
+ {
28
+ "Sid": "EC2Resource",
29
+ "Effect": "Allow",
30
+ "Action": [
31
+ "ec2:CreateTags",
32
+ "ec2:TerminateInstances"
33
+ ],
34
+ "Resource": [
35
+ "arn:aws:ec2:us-east-1:*"
36
+ ]
37
+ }
38
+ ]
39
+}