compute.yaml

Version: '2012-10-17'
Statement:

  # Restrict the types of instances that can be started
  # ASGs call run-instances --dry-run so the actions need to be grouped
  - Sid: AllowRunInstancesInstanceType
    Effect: Allow
    Action:
      - autoscaling:AttachInstances
      - autoscaling:CreateAutoScalingGroup
      - autoscaling:CreateLaunchConfiguration
      - autoscaling:UpdateAutoScalingGroup
      - autoscaling:DetachInstances
      - ec2:RunInstances
      - ec2:StartInstances
    Resource:
      - 'arn:aws:autoscaling:{{ aws_region }}:{{ aws_account_id }}:launchConfiguration:*'
      - 'arn:aws:autoscaling:{{ aws_region }}:{{ aws_account_id }}:autoScalingGroup:*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:instance/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:image/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:launch-template/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:snapshot/*'
    Condition:
      StringEqualsIfExists:
        ec2:InstanceType:
          - t2.nano
          - t2.micro
          - t3.nano
          - t3.micro
          - t3a.micro
          - m1.large  # lowest cost instance type with EBS optimization supported

  # Permit RunInstance to access any of the usual objects attached to an
  # instance
  - Sid: AllowEc2RunInstances
    Effect: Allow
    Action:
      - ec2:RunInstances
    Resource:
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:key-pair/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:network-interface/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:placement-group/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:security-group/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:subnet/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:volume/*'
      - 'arn:aws:ec2:{{ aws_region }}::image/*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:launch-template/*'
      - 'arn:aws:autoscaling:{{ aws_region }}:{{ aws_account_id }}:autoScalingGroup*'

  - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - ec2:AttachVolume
      - ec2:CancelSpotInstanceRequests
      - ec2:CreateImage
      - ec2:CreateKeyPair
      - ec2:CreateLaunchTemplate
      - ec2:CreateLaunchTemplateVersion
      - ec2:CreatePlacementGroup
      - ec2:CreateSnapshot
      - ec2:CreateTags
      - ec2:DeleteKeyPair
      - ec2:DeleteLaunchTemplate
      - ec2:DeleteLaunchTemplateVersions
      - ec2:DeletePlacementGroup
      - ec2:DeleteSnapshot
      - ec2:DeleteTags
      - ec2:DeregisterImage
      - ec2:DetachVolume
      - ec2:DisassociateIamInstanceProfile
      - ec2:Get*
      - ec2:ImportKeyPair
      - ec2:ModifyImageAttribute
      - ec2:ModifyInstanceAttribute
      - ec2:ModifyInstanceMetadataOptions
      - ec2:ModifyLaunchTemplate
      - ec2:ModifySnapshotAttribute
      - ec2:ModifyVolume
      - ec2:RegisterImage
      - ec2:ReplaceIamInstanceProfileAssociation
      - ec2:ResetSnapshotAttribute
      - ec2:StopInstances
      - ec2:TerminateInstances
    Resource:
      - "*"
    Condition:
      StringEquals:
        ec2:Region:
          - '{{ aws_region }}'

  # Spot Request permissions need to be pretty open
  # https://stackoverflow.com/questions/36570812/aws-ec2-iam-policy-for-ec2requestspotinstances
  - Sid: AllowGlobalUnrestrictedResourceActionsWhichIncurFees
    Effect: Allow
    Action:
      - ec2:RequestSpotInstances
    Resource:
      - "*"
    Condition:
      StringEqualsIfExists:
        ec2:InstanceType:
          - t2.nano
          - t2.micro
          - t3.nano
          - t3.micro
          - t3a.micro
          - m1.large  # lowest cost instance type with EBS optimization supported

  # ASG and ELB don't like being region restricted.
  - Sid: AllowGlobalUnrestrictedResourceActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - autoscaling:Describe*
      - autoscaling:ResumeProcesses
      - autoscaling:SuspendProcesses
      - ec2:Describe*
      - elasticloadbalancing:DeleteRule
      - elasticloadbalancing:DeleteListener
      - elasticloadbalancing:Describe*
      - elasticloadbalancing:DeregisterTargets
      - elasticloadbalancing:ModifyListener
      - elasticloadbalancing:ModifyTargetGroupAttributes
      - elasticloadbalancing:ModifyRule
      - elasticloadbalancing:SetIpAddressType
      - elasticloadbalancing:SetRulePriorities
    Resource:
      - "*"

  - Sid: AllowGlobalRestrictedResourceActionsWhichIncurFees
    Effect: Allow
    Action:
      - autoscaling:EnableMetricsCollection
      - ec2:CreateVolume
      - elasticloadbalancing:CreateLoadBalancer*
      - elasticloadbalancing:CreateRule
    Resource:
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:volume/*'
      - 'arn:aws:elasticloadbalancing:{{ aws_region }}:{{ aws_account_id }}:*'
      - 'arn:aws:autoscaling:{{ aws_region }}:{{ aws_account_id }}:autoScalingGroup*'

  - Sid: AllowGlobalResourceRestrictedActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - autoscaling:AttachLoadBalancerTargetGroups
      - autoscaling:CancelInstanceRefresh
      - autoscaling:CompleteLifecycleAction
      - autoscaling:CreateOrUpdateTags
      - autoscaling:Delete*
      - autoscaling:DetachLoadBalancers
      - autoscaling:DetachLoadBalancerTargetGroups
      - autoscaling:DisableMetricsCollection
      - autoscaling:PutScalingPolicy
      - autoscaling:PutScheduledUpdateGroupAction
      - autoscaling:PutLifecycleHook
      - autoscaling:StartInstanceRefresh
      - autoscaling:SetInstanceHealth
      - autoscaling:SetInstanceProtection
      - autoscaling:TerminateInstanceInAutoScalingGroup
      - ec2:DeleteVolume
      - elasticloadbalancing:AddListenerCertificates
      - elasticloadbalancing:AddTags
      - elasticloadbalancing:ApplySecurityGroupsToLoadBalancer
      - elasticloadbalancing:AttachLoadBalancerToSubnets
      - elasticloadbalancing:ConfigureHealthCheck
      - elasticloadbalancing:CreateAppCookieStickinessPolicy
      - elasticloadbalancing:CreateLBCookieStickinessPolicy
      - elasticloadbalancing:CreateListener
      - elasticloadbalancing:CreateTargetGroup
      - elasticloadbalancing:Delete*
      - elasticloadbalancing:DeregisterInstancesFromLoadBalancer
      - elasticloadbalancing:DetachLoadBalancerFromSubnets
      - elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer
      - elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer
      - elasticloadbalancing:ModifyLoadBalancerAttributes
      - elasticloadbalancing:RemoveTags
      - elasticloadbalancing:RegisterInstancesWithLoadBalancer
      - elasticloadbalancing:RegisterTargets
      - elasticloadbalancing:SetLoadBalancer*
      - elasticloadbalancing:SetSecurityGroups
      - elasticloadbalancing:SetWebACL
    Resource:
      - 'arn:aws:autoscaling:{{ aws_region }}:{{ aws_account_id }}:launchConfiguration:*'
      - 'arn:aws:autoscaling:{{ aws_region }}:{{ aws_account_id }}:autoScalingGroup:*'
      - 'arn:aws:ec2:{{ aws_region }}:{{ aws_account_id }}:volume/*'
      - 'arn:aws:elasticfilesystem:{{ aws_region }}:{{ aws_account_id }}:file-system/*'
      - 'arn:aws:elasticloadbalancing:{{ aws_region }}:{{ aws_account_id }}:targetgroup/*'
      - 'arn:aws:elasticloadbalancing:{{ aws_region }}:{{ aws_account_id }}:loadbalancer/*'
      - 'arn:aws:elasticloadbalancing:{{ aws_region }}:{{ aws_account_id }}:listener/*'