2
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

Serverless Framworkを使ってdeployするときの必要最低限の権限

Posted at

ServerlessFrameworkではAdministrator権限付与することになっていますが、ダメって言われたので調べました。
ServerlessFrameworkでデプロイ、Lambdaを実行するためだけの権限です。

Serverless Frameworkで使用するIAMのユーザーに、
下の内容をポリシーのJSONに記載して、そのポリシーをユーザーに付与すれば可能

###ポリシーのJSON

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "events:EnableRule",
                "logs:DescribeLogStreams",
                "events:PutRule",
                "iam:GenerateServiceLastAccessedDetails",
                "s3:CreateBucket",
                "cloudformation:DescribeStackResource",
                "s3:ListBucket",
                "cloudformation:CreateChangeSet",
                "s3:GetBucketPolicy",
                "s3:GetObjectAcl",
                "iam:PassRole",
                "cloudformation:DescribeStackEvents",
                "events:ListRules",
                "cloudformation:UpdateStack",
                "logs:FilterLogEvents",
                "s3:DeleteObject",
                "cloudformation:ExecuteChangeSet",
                "events:DisableRule",
                "events:PutEvents",
                "iam:ListPolicies",
                "iam:GetRole",
                "events:DescribeRule",
                "iam:ListSAMLProviders",
                "iam:ListGroupPolicies",
                "logs:CreateLogGroup",
                "events:TestEventPattern",
                "cloudformation:DescribeStacks",
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutBucketNotification",
                "s3:ListAllMyBuckets",
                "cloudformation:CreateStack",
                "lambda:*",
                "s3:GetBucketLocation",
                "cloudformation:ValidateTemplate"
            ],
            "Resource": "*"
        }
    ]
}

これでServerlessFrameWork でdeploy,実行はできました。
正直やっている途中で雑に権限を付与したので、不要なものもあると思います。

参考にした記事
[【AWS x S3 x IAM】アプリから S3 にデータをアップロードするときの IAM 権限設定]
(https://qiita.com/tanakaworld/items/196300d556feada5737b)

2
1
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
2
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?