manuelver/EjemplosPoliticasAWS
manuelver/EjemplosPoliticasAWS
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Politicas IAM

Browse Source
This commit is contained in:
vergman2 2022-09-01 02:03:46 +02:00
parent 65b201bf51
commit 8ca5392426
22 changed files with 543 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
IAM/AccesoAPIsimuladorPoliticasRutaUsuario.json Normal file
View File

@ -0,0 +1,13 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:GetContextKeysForPrincipalPolicy",
"iam:SimulatePrincipalPolicy"
],
"Effect": "Allow",
"Resource": "arn:aws:iam::*:user/Department/Development/*"
}
]
}

14
IAM/AsumirFuncionesEtiqueta.json Normal file
View File

@ -0,0 +1,14 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AssumeTaggedRole",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "*",
"Condition": {
"StringEquals": {"iam:ResourceTag/Project": "ExampleCorpABC"}
}
}
]
}

15
IAM/accesoAPIsimuladorPoliticas.json Normal file
View File

@ -0,0 +1,15 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:GetContextKeysForCustomPolicy",
"iam:GetContextKeysForPrincipalPolicy",
"iam:SimulateCustomPolicy",
"iam:SimulatePrincipalPolicy"
],
"Effect": "Allow",
"Resource": "*"
}
]
}

29
IAM/accesoConsolasSimuladorPoliticas.json Normal file
View File

@ -0,0 +1,29 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:GetGroup",
"iam:GetGroupPolicy",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetUser",
"iam:GetUserPolicy",
"iam:ListAttachedGroupPolicies",
"iam:ListAttachedRolePolicies",
"iam:ListAttachedUserPolicies",
"iam:ListGroups",
"iam:ListGroupPolicies",
"iam:ListGroupsForUser",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:ListUserPolicies",
"iam:ListUsers"
],
"Effect": "Allow",
"Resource": "*"
}
]
}

15
IAM/adminEtiqueta.json Normal file
View File

@ -0,0 +1,15 @@
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:TagUser",
"iam:TagRole",
"iam:UntagUser",
"iam:UntagRole"
],
"Resource": "*",
"Condition": {"ForAllValues:StringEquals": {"aws:TagKeys": "Department"}}
}
}

30
IAM/agregarEtiquetaUsuarioConEtiqueta.json Normal file
View File

@ -0,0 +1,30 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ListTagsForAllUsers",
"Effect": "Allow",
"Action": [
"iam:ListUserTags",
"iam:ListUsers"
],
"Resource": "*"
},
{
"Sid": "TagManagerWithSpecificDepartment",
"Effect": "Allow",
"Action": "iam:TagUser",
"Resource": "*",
"Condition": {"StringEquals": {
"iam:ResourceTag/JobFunction": "Manager",
"aws:RequestTag/Department": [
"Marketing",
"Development",
"QualityAssurance"
]
},
"ForAllValues:StringEquals": {"aws:TagKeys": "Department"}
}
}
]
}

36
IAM/agregarEtiquetaUsuarioConValores.json Normal file
View File

@ -0,0 +1,36 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ConsoleDisplay",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:GetUser",
"iam:ListRoles",
"iam:ListRoleTags",
"iam:ListUsers",
"iam:ListUserTags"
],
"Resource": "*"
},
{
"Sid": "AddTag",
"Effect": "Allow",
"Action": [
"iam:TagUser",
"iam:TagRole"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CostCenter": [
"A-123",
"B-456"
]
},
"ForAllValues:StringEquals": {"aws:TagKeys": "CostCenter"}
}
}
]
}

29
IAM/crearUsuariosConEtiquetas.json Normal file
View File

@ -0,0 +1,29 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "TagUsersWithOnlyTheseTags",
"Effect": "Allow",
"Action": [
"iam:CreateUser",
"iam:TagUser"
],
"Resource": "*",
"Condition": {
"StringEqualsIfExists": {
"aws:RequestTag/Department": [
"Development",
"QualityAssurance"
],
"aws:RequestTag/JobFunction": "Employee"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Department",
"JobFunction"
]
}
}
}
]
}

22
IAM/denegarAccesoRecursosFueraDeCuentaExceptoPoliticasIAM.json Normal file
View File

@ -0,0 +1,22 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccessToResourcesInSpecificAccountsAndSpecificService1",
"Effect": "Deny",
"NotAction":[
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListEntitiesForPolicy",
"iam:ListPolicies"
],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:ResourceAccount": [
"111122223333"
]
},
}
}
}

11
IAM/generarRecuperarInformesCredenciales.json Normal file
View File

@ -0,0 +1,11 @@
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:GenerateCredentialReport",
"iam:GetCredentialReport"
],
"Resource": "*"
}
}

19
IAM/limitarPoliticasAplicarUsuario.json Normal file
View File

@ -0,0 +1,19 @@
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:AttachUserPolicy",
"iam:DetachUserPolicy"
],
"Resource": "*",
"Condition": {
"ArnEquals": {
"iam:PolicyARN": [
"arn:aws:iam::*:policy/policy-name-1",
"arn:aws:iam::*:policy/policy-name-2"
]
}
}
}
}

13
IAM/pasarFuncionIAMaServicio.json Normal file
View File

@ -0,0 +1,13 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {"iam:PassedToService": "cloudwatch.amazonaws.com"}
}
}
]
}

12
IAM/permiteAccesoLecturaConsolaIAMconInformes.json Normal file
View File

@ -0,0 +1,12 @@
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:Get*",
"iam:List*",
"iam:Generate*"
],
"Resource": "*"
}
}

11
IAM/permiteAccesoLecturaConsolaIAMsinInformes.json Normal file
View File

@ -0,0 +1,11 @@
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:Get*",
"iam:List*"
],
"Resource": "*"
}
}

24
IAM/permiteAccesoSimuladorPoliticasRutaAcceso.json Normal file
View File

@ -0,0 +1,24 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:GetPolicy",
"iam:GetUserPolicy"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"iam:GetUser",
"iam:ListAttachedUserPolicies",
"iam:ListGroupsForUser",
"iam:ListUserPolicies",
"iam:ListUsers"
],
"Effect": "Allow",
"Resource": "arn:aws:iam::*:user/Department/Development/*"
}
]
}

26
IAM/permiteAdminPertenenciaGrupo.json Normal file
View File

@ -0,0 +1,26 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ViewGroups",
"Effect": "Allow",
"Action": [
"iam:ListGroups",
"iam:ListUsers",
"iam:GetUser",
"iam:ListGroupsForUser"
],
"Resource": "*"
},
{
"Sid": "ViewEditThisGroup",
"Effect": "Allow",
"Action": [
"iam:AddUserToGroup",
"iam:RemoveUserFromGroup",
"iam:GetGroup"
],
"Resource": "arn:aws:iam::*:group/MarketingTeam"
}
]
}

11
IAM/permiteRequisitosPassword.json Normal file
View File

@ -0,0 +1,11 @@
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:GetAccountPasswordPolicy",
"iam:UpdateAccountPasswordPolicy"
],
"Resource": "*"
}
}

42
IAM/permiteUsuariosAdminGrupo.json Normal file
View File

@ -0,0 +1,42 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAllUsersToListAllGroups",
"Effect": "Allow",
"Action": "iam:ListGroups",
"Resource": "*"
},
{
"Sid": "AllowAllUsersToViewAndManageThisGroup",
"Effect": "Allow",
"Action": "iam:*Group*",
"Resource": "arn:aws:iam::*:group/AllUsers"
},
{
"Sid": "LimitGroupManagementAccessToSpecificUsers",
"Effect": "Deny",
"Action": [
"iam:AddUserToGroup",
"iam:CreateGroup",
"iam:RemoveUserFromGroup",
"iam:DeleteGroup",
"iam:AttachGroupPolicy",
"iam:UpdateGroup",
"iam:DetachGroupPolicy",
"iam:DeleteGroupPolicy",
"iam:PutGroupPolicy"
],
"Resource": "arn:aws:iam::*:group/AllUsers",
"Condition": {
"StringNotEquals": {
"aws:username": [
"srodriguez",
"mjackson",
"adesai"
]
}
}
}
]
}

73
IAM/permiteUsuariosAdminMFA.json Normal file
View File

@ -0,0 +1,73 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowListActions",
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:ListVirtualMFADevices"
],
"Resource": "*"
},
{
"Sid": "AllowIndividualUserToListOnlyTheirOwnMFA",
"Effect": "Allow",
"Action": [
"iam:ListMFADevices"
],
"Resource": [
"arn:aws:iam::*:mfa/*",
"arn:aws:iam::*:user/${aws:username}"
]
},
{
"Sid": "AllowIndividualUserToManageTheirOwnMFA",
"Effect": "Allow",
"Action": [
"iam:CreateVirtualMFADevice",
"iam:DeleteVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ResyncMFADevice"
],
"Resource": [
"arn:aws:iam::*:mfa/${aws:username}",
"arn:aws:iam::*:user/${aws:username}"
]
},
{
"Sid": "AllowIndividualUserToDeactivateOnlyTheirOwnMFAOnlyWhenUsingMFA",
"Effect": "Allow",
"Action": [
"iam:DeactivateMFADevice"
],
"Resource": [
"arn:aws:iam::*:mfa/${aws:username}",
"arn:aws:iam::*:user/${aws:username}"
],
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
},
{
"Sid": "BlockMostAccessUnlessSignedInWithMFA",
"Effect": "Deny",
"NotAction": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ListMFADevices",
"iam:ListUsers",
"iam:ListVirtualMFADevices",
"iam:ResyncMFADevice"
],
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}

24
IAM/permiteUsuariosCambiarCredenciales.json Normal file
View File

@ -0,0 +1,24 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:GetAccountPasswordPolicy"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:*AccessKey*",
"iam:ChangePassword",
"iam:GetUser",
"iam:*ServiceSpecificCredential*",
"iam:*SigningCertificate*"
],
"Resource": ["arn:aws:iam::*:user/${aws:username}"]
}
]
}

50
IAM/permitirDenegarAccesoServicios.json Normal file
View File

@ -0,0 +1,50 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowServices",
"Effect": "Allow",
"Action": [
"s3:*",
"cloudwatch:*",
"ec2:*"
],
"Resource": "*"
},
{
"Sid": "AllowIAMConsoleForCredentials",
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:GetAccountPasswordPolicy"
],
"Resource": "*"
},
{
"Sid": "AllowManageOwnPasswordAndAccessKeys",
"Effect": "Allow",
"Action": [
"iam:*AccessKey*",
"iam:ChangePassword",
"iam:GetUser",
"iam:*LoginProfile*"
],
"Resource": ["arn:aws:iam::*:user/${aws:username}"]
},
{
"Sid": "DenyS3Logs",
"Effect": "Deny",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::logs",
"arn:aws:s3:::logs/*"
]
},
{
"Sid": "DenyEC2Production",
"Effect": "Deny",
"Action": "ec2:*",
"Resource": "arn:aws:ec2:*:*:instance/i-1234567890abcdef0"
}
]
}

24
IAM/verUltimoAccesoServicio.json Normal file
View File

@ -0,0 +1,24 @@
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowOrgsReadOnlyAndIamGetReport",
"Effect": "Allow",
"Action": [
"iam:GetOrganizationsAccessReport",
"organizations:Describe*",
"organizations:List*"
],
"Resource": "*"
},
{
"Sid": "AllowGenerateReportOnlyForThePolicy",
"Effect": "Allow",
"Action": "iam:GenerateOrganizationsAccessReport",
"Resource": "*",
"Condition": {
"StringEquals": {"iam:OrganizationsPolicyId": "p-policy123"}
}
}
]
}