elasticstack/policy.json at master · DevOps-Coach/elasticstack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": "ec2:RunInstance",
      "Resource": "*",
      "Condition": {
        "StringEqualsIfExists": {
          "ec2:VolumeType": "gp2",
          "ec2:InstanceType": [
            "m2.small",
            "m2.middle"
          ]
        },
        "NumericLessThan": {
          "ec2:VolumeSize": "80"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstance"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "cn-northwest-1",
          "ec2:instancetype": "m2.middle",
          "ec2.volumetype": "gp2"
        },
        "NumericLessThan": {
          "ec2:VolumeSize": "80"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDescribeForAllResources",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OnlyAllowCertainInstanceTypesToBeCreated",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": [
            "t2.small",
            "t2.medium"
          ]
        }
      }
    },
    {
      "Sid": "AllowAdditionalResourcesToSupportLaunchingEC2ClassicInstances",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:cn-northwest-1:537314087009key-pair/*",
        "arn:aws:ec2:cn-northwest-1:537314087009security-group/*",
        "arn:aws:ec2:cn-northwest-1:537314087009volume/*",
        "arn:aws:ec2:cn-northwest-1::image/ami-*"
      ]
    },
    {
      "Sid": "AllowUserToStopStartDeleteInstances",
      "Effect": "Allow",
      "Action": [
        "ec2:TerminateInstances",
        "ec2:StopInstances",
        "ec2:StartInstances"
      ],
      "Resource": "arn:aws:ec2:cn-northwest-1:537314087009instance/*"
    }
  ]
}


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeImages",
        "ec2:DescribeKeyPairs",
        "ec2:CreateKeyPair",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:CreateSecurityGroup",
        "ec2:AuthorizeSecurityGroupIngress"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:cn-northwest-1:537314087009:network-interface/*",
        "arn:aws:ec2:cn-northwest-1:537314087009:volume/*",
        "arn:aws:ec2:cn-northwest-1:537314087009:key-pair/*",
        "arn:aws:ec2:cn-northwest-1:537314087009:security-group/*",
        "arn:aws:ec2:cn-northwest-1:537314087009:subnet/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:cn-northwest-1:537314087009:instance/*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": "t2.micro"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:cn-northwest-1::image/ami-*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:Owner": "martin"
        }
      }
    }
  ]
}


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "overrideBlockOnReq",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeImages",
        "ec2:DescribeKeyPairs",
        "ec2:CreateKeyPair",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:CreateSecurityGroup",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:RunInstances",
        "ec2:TerminateInstances",
        "ec2:StopInstances",
        "ec2:StartInstances"
      ],
      "Resource": "*"
    },
    {
      "Sid": "limitedSize",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringNotLike": {
          "ec2:InstanceType": [
            "t2.micro",
            "t2.medium"
          ]
        }
      }
    }
  ]
}