[WIP] AWS CloudFormationでIAMを管理する #AWS

ポリシー

ExamplePolicy:
  Type: AWS::IAM::ManagedPolicy
  Properties:
    PolicyDocument:
      Version: 2012-10-17
      Statement:
        - Sid: Stmt01
          Effect: Allow
          Action:
            - s3:ListObject
          Resource:
            - "*"

グループ

ExampleGroup:
  Type: AWS::IAM::Group
  Properties:
    GroupName: !Sub ${AWS::StackName}-testing
    ManagedPolicyArns:
      - !Ref ExamplePolicy

ユーザ

ExampleUser:
  Type: AWS::IAM::User
  Properties:
    UserName: !Sub ${AWS::StackName}-testing
    Groups:
      - !Ref ExampleGroup

ロール

ExampleRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: !Sub ${AWS::StackName}-testing
    ManagedPolicyArns:
      - !Ref AdminAccessPolicyArn
    AssumeRolePolicyDocument:
      Version: 2012-10-17
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - ec2.amazonaws.com
            Action:
              - sts:AssumeRole