IAM_Resources.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Template to Create IAM Resources
Resources:
  InstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      Roles:
      - !Ref Role
  Role:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'ec2.amazonaws.com'
          Action: 'sts:AssumeRole'
      Policies:
      - PolicyName: ecs
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ec2:DescribeTags'
            - 'ecs:CreateCluster'
            - 'ecs:DeregisterContainerInstance'
            - 'ecs:DiscoverPollEndpoint'
            - 'ecs:Poll'
            - 'ecs:RegisterContainerInstance'
            - 'ecs:StartTelemetrySession'
            - 'ecs:UpdateContainerInstancesState'
            - 'ecs:Submit*'
            - 'ecr:GetAuthorizationToken'
            - 'ecr:BatchCheckLayerAvailability'
            - 'ecr:GetDownloadUrlForLayer'
            - 'ecr:BatchGetImage'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            - 'ecs:SubmitContainerStateChange'
            - 'ecs:SubmitTaskStateChange'
            - 'ecs:ListContainerInstances'
            - 'ecs:ListTasks'
            - 'ecs:DescribeContainerInstances'
            Resource: '*'
  IAMPolicySSHAccess:
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles:
      - !Ref Role
      PolicyName: 'iam-ssh'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Action:
          - 'iam:ListUsers'
          Resource:
          - '*'
        - Effect: Allow
          Action:
          - 'iam:ListSSHPublicKeys'
          - 'iam:GetSSHPublicKey'
          Resource:
          - !Sub 'arn:aws:iam::${AWS::AccountId}:user/*'
  ECSTaskRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub 'Ecs-TaskRole-${AWS::StackName}'
      Path: /
      AssumeRolePolicyDocument: |
        {
            "Statement": [{
                "Effect": "Allow",
                "Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]},
                "Action": [ "sts:AssumeRole" ]
            }]
        }
      Policies:
        - PolicyName: !Sub 'Ecs-Task-${AWS::StackName}'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'ec2:Describe*'
                  - 'elasticloadbalancing:Describe*'
                Resource: '*'
  ECSTaskExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      Path: /
      AssumeRolePolicyDocument: |
        {
            "Statement": [{
                "Effect": "Allow",
                "Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]},
                "Action": [ "sts:AssumeRole" ]
            }]
        }
      Policies:
        - PolicyName: !Sub 'Ecs-TaskExecution-${AWS::StackName}'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'ecr:GetAuthorizationToken'
                  - 'ecr:BatchCheckLayerAvailability'
                  - 'ecr:GetDownloadUrlForLayer'
                  - 'ecr:BatchGetImage'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: '*'
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: 'sts:AssumeRole'
            Condition: {}
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Policies:
      - PolicyName: ASG_and_ECS-CP
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 'ecs:*'
            - 'application-autoscaling:*'
            - "autoscaling:UpdateAutoScalingGroup"
            - "autoscaling:SetInstanceProtection"
            - "autoscaling:PutScalingPolicy"
            - "autoscaling:Describe*"
            - "autoscaling:CreateOrUpdateTags"
            - "s3:List*"
            - "s3:Get*"
            - "iam:PassRole"
            - "iam:CreateServiceLinkedRole"
            - "sts:AssumeRole"
            Resource: '*'
Outputs:
  IAMInstanceProfile:
    Description: 'IAM Instance Profile for ECS Instances'
    Value: !Ref 'InstanceProfile'
  ECSTaskRole:
    Description: 'ECS Task Role'
    Value: !GetAtt
      - ECSTaskRole
      - Arn
  ECSTaskExecutionRole:
    Description: 'ECS Task Execution Role'
    Value: !GetAtt
      - ECSTaskExecutionRole
      - Arn
  LambdaExecutionRole:
    Description: 'Lambda Execution Role'
    Value: !GetAtt
      - LambdaExecutionRole
      - Arn