Added EMP IAM validation required permissions

platform9 · May 14, 2024 · 2f5ecab · 2f5ecab
1 parent d514f6f
commit 2f5ecab
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/emp/emp-aws-policies/aws-policy-2.json b/emp/emp-aws-policies/aws-policy-2.json
@@ -56,6 +56,12 @@
                 "iam:PutRolePolicy",
                 "iam:RemoveRoleFromInstanceProfile",
                 "iam:UntagRole",
+                "iam:ListUserPolicies",
+                "iam:ListAttachedUserPolicies",
+                "iam:GetUserPolicy",
+                "iam:GetPolicy",
+                "iam:GetPolicyVersion",
+                "iam:SimulateCustomPolicy",
                 "elasticfilesystem:Backup",
                 "elasticfilesystem:CreateAccessPoint",
                 "elasticfilesystem:CreateFileSystem",

diff --git a/emp/emp_iam_cftemplate.yml b/emp/emp_iam_cftemplate.yml
@@ -218,6 +218,12 @@ Resources:
           - iam:PutRolePolicy
           - iam:RemoveRoleFromInstanceProfile
           - iam:UntagRole
+          - iam:ListUserPolicies
+          - iam:ListAttachedUserPolicies
+          - iam:GetUserPolicy
+          - iam:GetPolicy
+          - iam:GetPolicyVersion
+          - iam:SimulateCustomPolicy
           - elasticfilesystem:Backup
           - elasticfilesystem:CreateAccessPoint
           - elasticfilesystem:CreateFileSystem