Description: Least privileged IAM role to deploy and manage a Code Ocean VPC with CloudFormation
Metadata:
  CodeOcean::VersionInfo:
    Version: v4.6.2
    Commit: d5f7aa791a15822ddcee2c41eff9d9a29b9925ee
Resources:
  LeastPrivilegedDeployRole723D8321:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
        Version: "2012-10-17"
      Description: Code Ocean deployment least privileged role
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - acm:DeleteCertificate
                  - acm:DescribeCertificate
                  - acm:RequestCertificate
                  - autoscaling:CreateAutoScalingGroup
                  - autoscaling:DeleteAutoScalingGroup
                  - autoscaling:DeleteLifecycleHook
                  - autoscaling:DeletePolicy
                  - autoscaling:DeleteWarmPool
                  - autoscaling:DescribeAutoScalingGroups
                  - autoscaling:DescribeAutoScalingInstances
                  - autoscaling:DescribeLifecycleHooks
                  - autoscaling:DescribePolicies
                  - autoscaling:DescribeScalingActivities
                  - autoscaling:DescribeScheduledActions
                  - autoscaling:DescribeWarmPool
                  - autoscaling:DisableMetricsCollection
                  - autoscaling:EnableMetricsCollection
                  - autoscaling:PutLifecycleHook
                  - autoscaling:PutScalingPolicy
                  - autoscaling:PutWarmPool
                  - autoscaling:SetDesiredCapacity
                  - autoscaling:TerminateInstanceInAutoScalingGroup
                  - autoscaling:UpdateAutoScalingGroup
                  - backup:CreateBackupPlan
                  - backup:CreateBackupSelection
                  - backup:CreateBackupVault
                  - backup:DeleteBackupPlan
                  - backup:DeleteBackupSelection
                  - backup:DeleteBackupVault
                  - backup:DeleteBackupVaultAccessPolicy
                  - backup:DescribeBackupVault
                  - backup:GetBackupPlan
                  - backup:GetBackupSelection
                  - backup:ListRecoveryPointsByBackupVault
                  - backup:PutBackupVaultAccessPolicy
                  - backup:UpdateBackupPlan
                  - backup-storage:MountCapsule
                  - batch:CreateComputeEnvironment
                  - batch:CreateJobQueue
                  - batch:DeleteComputeEnvironment
                  - batch:DeleteJobQueue
                  - batch:DescribeComputeEnvironments
                  - batch:DescribeJobQueues
                  - batch:UpdateComputeEnvironment
                  - batch:UpdateJobQueue
                  - cloudformation:ContinueUpdateRollback
                  - cloudformation:CreateChangeSet
                  - cloudformation:CreateStack
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:SetTypeDefaultVersion
                  - cloudformation:UpdateStack
                  - cloudwatch:DeleteAlarms
                  - cloudwatch:PutMetricAlarm
                  - ecr:CreatePullThroughCacheRule
                  - ecr:DeletePullThroughCacheRule
                  - ecr:UpdatePullThroughCacheRule
                  - elasticache:CreateCacheSubnetGroup
                  - elasticache:CreateReplicationGroup
                  - elasticache:DeleteCacheSubnetGroup
                  - elasticache:DeleteReplicationGroup
                  - elasticache:DescribeCacheSubnetGroups
                  - elasticache:DescribeReplicationGroups
                  - elasticfilesystem:CreateFileSystem
                  - elasticfilesystem:CreateMountTarget
                  - elasticfilesystem:DeleteFileSystem
                  - elasticfilesystem:DeleteFileSystemPolicy
                  - elasticfilesystem:DeleteMountTarget
                  - elasticfilesystem:DescribeBackupPolicy
                  - elasticfilesystem:DescribeFileSystemPolicy
                  - elasticfilesystem:DescribeFileSystems
                  - elasticfilesystem:DescribeLifecycleConfiguration
                  - elasticfilesystem:DescribeMountTargets
                  - elasticfilesystem:DescribeReplicationConfigurations
                  - elasticfilesystem:ModifyMountTargetSecurityGroups
                  - elasticfilesystem:PutFileSystemPolicy
                  - elasticfilesystem:PutLifecycleConfiguration
                  - elasticfilesystem:UpdateFileSystem
                  - elasticloadbalancing:ConfigureHealthCheck
                  - elasticloadbalancing:CreateListener
                  - elasticloadbalancing:CreateLoadBalancer
                  - elasticloadbalancing:CreateRule
                  - elasticloadbalancing:CreateTargetGroup
                  - elasticloadbalancing:DeleteListener
                  - elasticloadbalancing:DeleteLoadBalancer
                  - elasticloadbalancing:DeleteRule
                  - elasticloadbalancing:DeleteTargetGroup
                  - elasticloadbalancing:DescribeListeners
                  - elasticloadbalancing:DescribeLoadBalancers
                  - elasticloadbalancing:DescribeRules
                  - elasticloadbalancing:DescribeTargetGroups
                  - elasticloadbalancing:DescribeTargetGroupAttributes
                  - elasticloadbalancing:DescribeTargetHealth
                  - elasticloadbalancing:ModifyListener
                  - elasticloadbalancing:ModifyLoadBalancerAttributes
                  - elasticloadbalancing:ModifyRule
                  - elasticloadbalancing:ModifyTargetGroup
                  - elasticloadbalancing:ModifyTargetGroupAttributes
                  - elasticloadbalancing:SetLoadBalancerPoliciesOfListener
                  - es:CreateElasticsearchDomain
                  - es:DeleteElasticsearchDomain
                  - es:DescribeDomainChangeProgress
                  - es:DescribeElasticsearchDomain
                  - es:UpgradeDomain
                  - events:DeleteRule
                  - events:DescribeRule
                  - events:PutRule
                  - events:PutTargets
                  - events:RemoveTargets
                  - kms:CreateAlias
                  - kms:CreateGrant
                  - kms:CreateKey
                  - kms:Decrypt
                  - kms:DeleteAlias
                  - kms:DescribeKey
                  - kms:EnableKeyRotation
                  - kms:GenerateDataKey
                  - kms:GenerateDataKeyWithoutPlaintext
                  - kms:PutKeyPolicy
                  - lambda:AddPermission
                  - lambda:CreateFunction
                  - lambda:DeleteFunction
                  - lambda:GetFunction
                  - lambda:InvokeFunction
                  - lambda:RemovePermission
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - logs:CreateLogDelivery
                  - logs:CreateLogGroup
                  - logs:DeleteLogDelivery
                  - logs:DeleteLogGroup
                  - logs:DeleteMetricFilter
                  - logs:DescribeLogGroups
                  - logs:DescribeMetricFilters
                  - logs:PutMetricFilter
                  - logs:PutRetentionPolicy
                  - rds:CreateDBInstance
                  - rds:CreateDBParameterGroup
                  - rds:CreateDBSubnetGroup
                  - rds:DeleteDBInstance
                  - rds:DeleteDBParameterGroup
                  - rds:DeleteDBSubnetGroup
                  - rds:DescribeDBEngineVersions
                  - rds:DescribeDBInstances
                  - rds:DescribeDBParameterGroups
                  - rds:DescribeDBParameters
                  - rds:DescribeDBSubnetGroups
                  - rds:DescribeEngineDefaultParameters
                  - rds:ModifyDBInstance
                  - rds:ModifyDBParameterGroup
                  - rds:ModifyDBSubnetGroup
                  - rds:RebootDBInstance
                  - route53:AssociateVPCWithHostedZone
                  - route53:ChangeResourceRecordSets
                  - route53:CreateHostedZone
                  - route53:DeleteHostedZone
                  - route53:GetChange
                  - route53:GetHostedZone
                  - route53:ListQueryLoggingConfigs
                  - route53:ListResourceRecordSets
                  - route53:ListTagsForResource
                  - s3:CreateBucket
                  - s3:DeleteBucket
                  - s3:DeleteBucketPolicy
                  - s3:GetBucketPolicy
                  - s3:GetReplicationConfiguration
                  - s3:PutBucketAcl
                  - s3:PutBucketLogging
                  - s3:PutBucketPolicy
                  - s3:PutBucketPublicAccessBlock
                  - s3:PutBucketVersioning
                  - s3:PutEncryptionConfiguration
                  - s3:PutLifecycleConfiguration
                  - s3:PutBucketOwnershipControls
                  - s3:PutReplicationConfiguration
                  - secretsmanager:CreateSecret
                  - secretsmanager:DeleteSecret
                  - secretsmanager:GetRandomPassword
                  - secretsmanager:GetSecretValue
                  - secretsmanager:UpdateSecret
                  - sns:CreateTopic
                  - sns:DeleteTopic
                  - sns:GetTopicAttributes
                  - sns:ListSubscriptionsByTopic
                Effect: Allow
                Resource: "*"
              - Action: iam:PassRole
                Condition:
                  ForAllValues:StringEquals:
                    iam:PassedToService:
                      - backup.amazonaws.com
                      - bedrock.amazonaws.com
                      - ec2.amazonaws.com
                      - ecr.amazonaws.com
                      - events.amazonaws.com
                      - lambda.amazonaws.com
                      - s3.amazonaws.com
                      - vpc-flow-logs.amazonaws.com
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
          PolicyName: LeastPrivilegedDeploymentPolicy
        - PolicyDocument:
            Statement:
              - Action:
                  - ec2:AllocateAddress
                  - ec2:AssociateRouteTable
                  - ec2:AttachInternetGateway
                  - ec2:AuthorizeSecurityGroupEgress
                  - ec2:AuthorizeSecurityGroupIngress
                  - ec2:CreateFlowLogs
                  - ec2:CreateInternetGateway
                  - ec2:CreateLaunchTemplate
                  - ec2:CreateLaunchTemplateVersion
                  - ec2:CreateNatGateway
                  - ec2:CreateRoute
                  - ec2:CreateRouteTable
                  - ec2:CreateSecurityGroup
                  - ec2:CreateSubnet
                  - ec2:CreateVolume
                  - ec2:CreateVpc
                  - ec2:CreateVpcEndpoint
                  - ec2:DeleteFlowLogs
                  - ec2:DeleteInternetGateway
                  - ec2:DeleteLaunchTemplate
                  - ec2:DeleteNatGateway
                  - ec2:DeleteRoute
                  - ec2:DeleteRouteTable
                  - ec2:DeleteSecurityGroup
                  - ec2:DeleteSubnet
                  - ec2:DeleteVolume
                  - ec2:DeleteVpc
                  - ec2:DeleteVpcEndpoints
                  - ec2:DescribeAccountAttributes
                  - ec2:DescribeAddresses
                  - ec2:DescribeAvailabilityZones
                  - ec2:DescribeFlowLogs
                  - ec2:DescribeInstances
                  - ec2:DescribeInternetGateways
                  - ec2:DescribeLaunchTemplates
                  - ec2:DescribeLaunchTemplateVersions
                  - ec2:DescribeNatGateways
                  - ec2:DescribeRouteTables
                  - ec2:DescribeSecurityGroups
                  - ec2:DescribeSubnets
                  - ec2:DescribeVolumes
                  - ec2:DescribeVolumesModifications
                  - ec2:DescribeVpcEndpoints
                  - ec2:DescribeVpcs
                  - ec2:DetachInternetGateway
                  - ec2:DisassociateAddress
                  - ec2:DisassociateRouteTable
                  - ec2:ModifySubnetAttribute
                  - ec2:ModifyVolume
                  - ec2:ModifyVolumeAttribute
                  - ec2:ModifyVpcAttribute
                  - ec2:ModifyVpcEndpoint
                  - ec2:ReleaseAddress
                  - ec2:RevokeSecurityGroupEgress
                  - ec2:RevokeSecurityGroupIngress
                  - ec2:RunInstances
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
          PolicyName: LeastPrivilegedDeploymentEc2Policy
        - PolicyDocument:
            Statement:
              - Action:
                  - iam:AddRoleToInstanceProfile
                  - iam:AttachRolePolicy
                  - iam:CreateInstanceProfile
                  - iam:CreatePolicy
                  - iam:CreatePolicyVersion
                  - iam:CreateRole
                  - iam:CreateServiceLinkedRole
                  - iam:DeleteInstanceProfile
                  - iam:DeletePolicy
                  - iam:DeletePolicyVersion
                  - iam:DeleteRole
                  - iam:DeleteRolePolicy
                  - iam:DetachRolePolicy
                  - iam:GetInstanceProfile
                  - iam:GetPolicy
                  - iam:GetRole
                  - iam:GetRolePolicy
                  - iam:ListPolicyVersions
                  - iam:PutRolePolicy
                  - iam:RemoveRoleFromInstanceProfile
                  - iam:UpdateAssumeRolePolicy
                  - iam:UpdateRole
                  - iam:UpdateRoleDescription
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
          PolicyName: LeastPrivilegedDeploymentIamPolicy
        - PolicyDocument:
            Statement:
              - Action:
                  - acm:AddTagsToCertificate
                  - acm:RemoveTagsFromCertificate
                  - autoscaling:CreateOrUpdateTags
                  - autoscaling:DeleteTags
                  - backup:ListTags
                  - backup:TagResource
                  - backup:UntagResource
                  - batch:TagResource
                  - batch:UntagResource
                  - cloudwatch:TagResource
                  - cloudwatch:UntagResource
                  - ec2:CreateTags
                  - ec2:DeleteTags
                  - elasticache:AddTagsToResource
                  - elasticache:DescribeCacheClusters
                  - elasticache:ListTagsForResource
                  - elasticache:ModifyReplicationGroup
                  - elasticache:RemoveTagsFromResource
                  - elasticfilesystem:ListTagsForResource
                  - elasticfilesystem:TagResource
                  - elasticfilesystem:UntagResource
                  - elasticloadbalancing:AddTags
                  - elasticloadbalancing:DescribeTags
                  - elasticloadbalancing:RemoveTags
                  - es:AddTags
                  - es:ListTags
                  - es:RemoveTags
                  - es:UpdateDomainConfig
                  - es:UpdateElasticsearchDomainConfig
                  - iam:ListRoleTags
                  - iam:TagRole
                  - iam:UntagRole
                  - kms:ListResourceTags
                  - kms:TagResource
                  - kms:UntagResource
                  - lambda:ListTags
                  - lambda:TagResource
                  - lambda:UntagResource
                  - logs:ListTagsForResource
                  - logs:ListTagsLogGroup
                  - logs:TagLogGroup
                  - logs:TagResource
                  - logs:UntagResource
                  - rds:AddTagsToResource
                  - rds:ListTagsForResource
                  - rds:RemoveTagsFromResource
                  - route53:ChangeTagsForResource
                  - s3:PutBucketTagging
                  - secretsmanager:TagResource
                  - secretsmanager:UntagResource
                  - sns:ListTagsForResource
                  - sns:TagResource
                  - sns:UntagResource
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
          PolicyName: LeastPrivilegedDeploymentTaggingPolicy
        - PolicyDocument:
            Statement:
              - Action:
                  - bedrock:CreateInferenceProfile
                  - bedrock:DeleteDataSource
                  - bedrock:DeleteInferenceProfile
                  - bedrock:DeleteKnowledgeBase
                  - bedrock:GetDataSource
                  - bedrock:GetInferenceProfile
                  - bedrock:GetKnowledgeBase
                  - bedrock:ListDataSources
                  - bedrock:ListTagsForResource
                  - bedrock:TagResource
                  - bedrock:UntagResource
                  - neptune-graph:DeleteGraph
                  - neptune-graph:GetGraph
                Effect: Allow
                Resource: "*"
            Version: "2012-10-17"
          PolicyName: LeastPrivilegedDeploymentBedrockPolicy
      RoleName: CodeOceanLeastPrivilegedDeployRole

