Example IAM policies
Following is an example of permissions that are required for creating bucket and deploying the Data Gateway in Amazon Web Services (AWS).
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"lambda:CreateFunction",
"lambda:AddPermission",
"lambda:CreateAlias",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:InvokeFunction",
"lambda:ListVersionsByFunction",
"lambda:PublishVersion",
"s3:CreateBucket",
"s3:PutBucketNotification",
"iam:CreateRole",
"iam:CreatePolicy",
"iam:PutRolePolicy",
"iam:GetRole",
"iam:PassRole",
"sqs:CreateQueue",
"sqs:GetQueueAttributes",
"sqs:SetQueueAttributes"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"events:DescribeRule",
"events:PutRule",
"events:PutTargets"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": [
"cloudwatch:PutMetricAlarm"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": [
"sns:ListTopics",
"sns:CreateTopic",
"sns:SetTopicAttributes",
"sns:Subscribe"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Action": [
"s3:ListBucket"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::deployment_bucket_1",
]
},
{
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::deployment_bucket_1",
]
},
{
"Action": [
"apigateway:POST",
"apigateway:PATCH",
"apigateway:GET",
"apigateway:PUT"
],
"Effect": "Allow",
"Resource": [
"arn:aws:apigateway:AWS_region::/restapis",
"arn:aws:apigateway:AWS_region::/restapis/*",
"arn:aws:apigateway:AWS_region::/account"
]
},
{
"Action": [
"dynamodb:CreateTable",
"dynamodb:DescribeTable",
"dynamodb:PutItem"
],
"Effect": "Allow",
"Resource": "arn:aws:dynamodb:AWS_region:
AWS_account_ID:table/Veritas-DGW-*"
},
{
"Action": [
"cloudformation:GetTemplateSummary",
"cloudformation:ListStacks",
"cloudformation:CreateStack",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStacks",
"cloudformation:UpdateStack"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
Following is an example of permissions that are required for deleting the Data Gateway in Amazon Web Services (AWS).
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"lambda:DeleteFunction",
"lambda:RemovePermission",
"lambda:DeleteAlias",
"s3:DeleteBucket",
"iam:DeleteRole",
"iam:DeletePolicy",
"iam:DeleteRolePolicy",
"sqs:DeleteQueue"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"apigateway:DELETE"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"dynamodb:DeleteTable",
"dynamodb:DeleteItem"
],
"Effect": "Allow",
"Resource": "arn:aws:dynamodb:AWS_region:
AWS_account_ID:table/*"
},
{
"Action": [
"cloudwatch:DeleteAlarms"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"sns:DeleteTopic",
"sns:GetTopicAttributes"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"events:RemoveTargets",
"events:DeleteRule"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"cloudformation:DeleteStack"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
In the above examples, deployment_bucket_1 is the deployment bucket that contain the stack templates. AWS_account_ID is the account ID of your AWS account and AWS_region is the region where you are deploying the Data Gateway.
Note:
The deployment permission and the delete permission can also be combined into a single policy.