serverless-dev-iam.sample.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["cloudformation:List*", "cloudformation:Get*", "cloudformation:ValidateTemplate"],
      "Resource": ["*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack",
        "cloudformation:CreateUploadBucket",
        "cloudformation:DeleteStack",
        "cloudformation:Describe*",
        "cloudformation:UpdateStack"
      ],
      "Resource": [
        "arn:aws:cloudformation:eu-central-1:__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:stack/t1-ct-dev/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["lambda:Get*", "lambda:List*", "lambda:CreateFunction"],
      "Resource": ["*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:ListBucket",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy",
        "s3:ListBucketVersions",
        "s3:PutAccelerateConfiguration",
        "s3:GetEncryptionConfiguration",
        "s3:PutEncryptionConfiguration",
        "s3:DeleteBucketPolicy"
      ],
      "Resource": ["arn:aws:s3:::t1-ct*serverlessdeploy*"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::t1-ct*serverlessdeploy*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:AddPermission",
        "lambda:CreateAlias",
        "lambda:DeleteFunction",
        "lambda:InvokeFunction",
        "lambda:PublishVersion",
        "lambda:RemovePermission",
        "lambda:Update*"
      ],
      "Resource": [
        "arn:aws:lambda:eu-central-1:__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:function:t1-ct-dev-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["cloudwatch:GetMetricStatistics"],
      "Resource": ["*"]
    },
    {
      "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup"],
      "Resource": ["arn:aws:logs:eu-central-1:__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:*"],
      "Effect": "Allow"
    },
    {
      "Action": ["logs:PutLogEvents"],
      "Resource": ["arn:aws:logs:eu-central-1:__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:*"],
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": ["logs:DescribeLogStreams", "logs:DescribeLogGroups", "logs:FilterLogEvents"],
      "Resource": ["*"]
    },
    {
      "Effect": "Allow",
      "Action": ["events:Put*", "events:Remove*", "events:Delete*"],
      "Resource": [
        "arn:aws:events:eu-central-1:__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:rule/t1-ct-dev-eu-central-1"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["events:DescribeRule"],
      "Resource": [
        "arn:aws:events:eu-central-1:__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:rule/t1-ct-dev-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": ["iam:PassRole"],
      "Resource": ["arn:aws:iam::__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:role/*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DeleteRole"
      ],
      "Resource": [
        "arn:aws:iam::__REPLACE_WITH_YOUR_AWS_ACCOUNT_ID__:role/t1-ct-dev-eu-central-1-lambdaRole"
      ]
    }
  ]
}