Skip to content

Commit 45d836f

Browse files
rcastleyrcastley
committed
Fix to support AWS Profile and updated IAM Policy
1 parent 18024de commit 45d836f

File tree

2 files changed

+108
-61
lines changed

2 files changed

+108
-61
lines changed

‎workshop/aws/sfx/main.tf‎

Lines changed: 104 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
provider "aws" {
2-
profile = "default"
2+
profile = var.aws_profile
33
region = var.aws_region
44
}
55

@@ -40,66 +40,109 @@ resource "aws_iam_policy" "aws_read_permissions" {
4040
description = "SignalFx IAM Policy"
4141
policy = <<EOF
4242
{
43-
"Version": "2012-10-17",
44-
"Statement": [
45-
{
46-
"Action": [
47-
"dynamodb:ListTables",
48-
"dynamodb:DescribeTable",
49-
"dynamodb:ListTagsOfResource",
50-
"ec2:DescribeInstances",
51-
"ec2:DescribeInstanceStatus",
52-
"ec2:DescribeVolumes",
53-
"ec2:DescribeReservedInstances",
54-
"ec2:DescribeReservedInstancesModifications",
55-
"ec2:DescribeTags",
56-
"organizations:DescribeOrganization",
57-
"cloudwatch:ListMetrics",
58-
"cloudwatch:GetMetricData",
59-
"cloudwatch:GetMetricStatistics",
60-
"cloudwatch:DescribeAlarms",
61-
"sqs:ListQueues",
62-
"sqs:GetQueueAttributes",
63-
"sqs:ListQueueTags",
64-
"elasticmapreduce:ListClusters",
65-
"elasticmapreduce:DescribeCluster",
66-
"kinesis:ListShards",
67-
"kinesis:ListStreams",
68-
"kinesis:DescribeStream",
69-
"kinesis:ListTagsForStream",
70-
"rds:DescribeDBInstances",
71-
"rds:ListTagsForResource",
72-
"elasticloadbalancing:DescribeLoadBalancers",
73-
"elasticloadbalancing:DescribeTags",
74-
"elasticache:describeCacheClusters",
75-
"redshift:DescribeClusters",
76-
"lambda:GetAlias",
77-
"lambda:ListFunctions",
78-
"lambda:ListTags",
79-
"autoscaling:DescribeAutoScalingGroups",
80-
"s3:ListAllMyBuckets",
81-
"s3:ListBucket",
82-
"s3:GetBucketLocation",
83-
"s3:GetBucketTagging",
84-
"ecs:ListServices",
85-
"ecs:ListTasks",
86-
"ecs:DescribeTasks",
87-
"ecs:DescribeServices",
88-
"ecs:ListClusters",
89-
"ecs:DescribeClusters",
90-
"ecs:ListTaskDefinitions",
91-
"ecs:ListTagsForResource",
92-
"apigateway:GET",
93-
"cloudfront:ListDistributions",
94-
"cloudfront:ListTagsForResource",
95-
"tag:GetResources",
96-
"es:ListDomainNames",
97-
"es:DescribeElasticsearchDomain"
98-
],
99-
"Effect": "Allow",
100-
"Resource": "*"
101-
}
102-
]
43+
"Version": "2012-10-17",
44+
"Statement": [
45+
{
46+
"Effect": "Allow",
47+
"Action": [
48+
"airflow:GetEnvironment",
49+
"airflow:ListEnvironments",
50+
"apigateway:GET",
51+
"autoscaling:DescribeAutoScalingGroups",
52+
"cloudformation:ListResources",
53+
"cloudformation:GetResource",
54+
"cloudfront:GetDistributionConfig",
55+
"cloudfront:ListDistributions",
56+
"cloudfront:ListTagsForResource",
57+
"cloudwatch:GetMetricData",
58+
"cloudwatch:ListMetrics",
59+
"directconnect:DescribeConnections",
60+
"dynamodb:DescribeTable",
61+
"dynamodb:ListTables",
62+
"dynamodb:ListTagsOfResource",
63+
"ec2:DescribeInstances",
64+
"ec2:DescribeInstanceStatus",
65+
"ec2:DescribeNatGateways",
66+
"ec2:DescribeRegions",
67+
"ec2:DescribeReservedInstances",
68+
"ec2:DescribeReservedInstancesModifications",
69+
"ec2:DescribeTags",
70+
"ec2:DescribeVolumes",
71+
"ecs:DescribeClusters",
72+
"ecs:DescribeServices",
73+
"ecs:DescribeTasks",
74+
"ecs:ListClusters",
75+
"ecs:ListServices",
76+
"ecs:ListTagsForResource",
77+
"ecs:ListTaskDefinitions",
78+
"ecs:ListTasks",
79+
"eks:DescribeCluster",
80+
"eks:ListClusters",
81+
"elasticache:DescribeCacheClusters",
82+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
83+
"elasticloadbalancing:DescribeLoadBalancers",
84+
"elasticloadbalancing:DescribeTags",
85+
"elasticloadbalancing:DescribeTargetGroups",
86+
"elasticmapreduce:DescribeCluster",
87+
"elasticmapreduce:ListClusters",
88+
"es:DescribeElasticsearchDomain",
89+
"es:ListDomainNames",
90+
"kafka:DescribeCluster",
91+
"kafka:DescribeClusterV2",
92+
"kafka:ListClusters",
93+
"kafka:ListClustersV2",
94+
"kinesis:DescribeStream",
95+
"kinesis:ListShards",
96+
"kinesis:ListStreams",
97+
"kinesis:ListTagsForStream",
98+
"kinesisanalytics:DescribeApplication",
99+
"kinesisanalytics:ListApplications",
100+
"kinesisanalytics:ListTagsForResource",
101+
"lambda:GetAlias",
102+
"lambda:ListFunctions",
103+
"lambda:ListTags",
104+
"logs:DeleteSubscriptionFilter",
105+
"logs:DescribeLogGroups",
106+
"logs:DescribeSubscriptionFilters",
107+
"logs:PutSubscriptionFilter",
108+
"organizations:DescribeOrganization",
109+
"rds:DescribeDBInstances",
110+
"rds:DescribeDBClusters",
111+
"rds:ListTagsForResource",
112+
"redshift:DescribeClusters",
113+
"redshift:DescribeLoggingStatus",
114+
"s3:GetBucketLocation",
115+
"s3:GetBucketLogging",
116+
"s3:GetBucketNotification",
117+
"s3:GetBucketTagging",
118+
"s3:ListAllMyBuckets",
119+
"s3:ListBucket",
120+
"s3:PutBucketNotification",
121+
"sqs:GetQueueAttributes",
122+
"sqs:ListQueues",
123+
"sqs:ListQueueTags",
124+
"states:ListActivities",
125+
"states:ListStateMachines",
126+
"tag:GetResources",
127+
"workspaces:DescribeWorkspaces"
128+
],
129+
"Resource": "*"
130+
},
131+
{
132+
"Effect": "Allow",
133+
"Action": [
134+
"cassandra:Select"
135+
],
136+
"Resource": [
137+
"arn:aws:cassandra:*:*:/keyspace/system/table/local",
138+
"arn:aws:cassandra:*:*:/keyspace/system/table/peers",
139+
"arn:aws:cassandra:*:*:/keyspace/system_schema/*",
140+
"arn:aws:cassandra:*:*:/keyspace/system_schema_mcs/table/tags",
141+
"arn:aws:cassandra:*:*:/keyspace/system_schema_mcs/table/tables",
142+
"arn:aws:cassandra:*:*:/keyspace/system_schema_mcs/table/columns"
143+
]
144+
}
145+
]
103146
}
104147
EOF
105148
}

‎workshop/aws/sfx/variables.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
variable "aws_profile" {
2+
description = "AWS profile to use for the AWS provider."
3+
}
4+
15
variable "aws_region" {
26
description = "Provide the desired region (for example: us-west-2)"
37
}

0 commit comments

Comments
 (0)