创建云形式仅AWS策略

Question

我想在AWS中创建一个策略和角色，该策略和角色只能通过云形式而不是通过控制台创建资源。什么是实现这一目标的最佳方法？

Answer 1

实现您想要做的事情的最简单方法是创建云形式服务角色，并授予您的用户将此角色传递给云形式，并执行云形式创造，更新等

我已经创建了一个具有起点角色的云形式模板，并具有应执行您想要的工作的策略的组。

• CloudFormationServiceRole：云形式使用的实际作用，并在AWS中执行操作的权限
• UsersGroup：将您的用户添加到的组。它有权在云形式中执行操作并通过CloudFormationServiceRole，而没有其他操作。

---

AWSTemplateFormatVersion: 2010-09-09
Resources:
  CloudFormationServiceRole:
    # This Role will actually do all of the heavy lifting and resouce
    # creation
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - cloudformation.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        -
          PolicyName: CloudformationAccess
          PolicyDocument:
            # This policy defines what the users can actually do
            # With Cloudformation
            Version: 2012-10-17
            Statement:
              - 
                Effect: Allow
                Action: "*"
                Resource: "*"
  UsersGroup:
    # The users will use the role, but do nothing themselves
    Type: AWS::IAM::Group
    Properties:
      Policies:
        -
          PolicyName: UsersCloudformationAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - 
                Effect: Allow
                Action:
                  - cloudformation:*
                Resource: "*"
              -
                Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:PassRole
                Resource: !GetAtt CloudFormationServiceRole.Arn