Elastic Beanstalk: permet à l'utilisateur de se déployer

Question

Je n'arrive pas à comprendre comment permettre à d'autres personnes de mon entreprise de se déployer sur un serveur (de test) avec AWS Elastic Beanstalk.

Cette page indique que le contrôle global d'autorisation sur le ELB: http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.managed-policies.html

Answer 1

Le blog Godfrey Rhys intitulé Using IAM to secure Elastic Beanstalk Applications on AWS a une bonne orientation.

Nous avons une application Elastic Beanstalk et un groupe d'utilisateurs. Ce groupe d'utilisateurs devrait être en mesure de surveiller et de déployer uniquement vers l'environnement d'haricot élastique , ainsi que de redémarrer ou de mettre fin à l'instance d'application . Ils ne doivent pas pouvoir modifier la configuration de l'application ou de l'environnement ni supprimer l'environnement. L'utilisateur ne doit pas pouvoir affecter d'autres applications ou services AWS , mais il est acceptable pour eux de voir des détails sur d'autres zones. Nous supposons que l'utilisateur utilisera la console AWS.

J'ai redéposé les politiques IAM ici pour référence. La bonne chose à propos de son approche est qu'il considère l'environnement de l'application en référençant une balise EC2 sur les instances EG Environment=testing, ce dont vous avez besoin dans votre cas d'utilisation.

{ 
    "Version":"2012-10-17", 
    "Statement":[ 
     { 
     "Sid":"ElasticBeanstalkEnvironmentPermissions", 
     "Effect":"Allow", 
     "Action":[ 
      "elasticbeanstalk:DescribeEnvironmentResources", 
      "elasticbeanstalk:DescribeEnvironments", 
      "elasticbeanstalk:DescribeEvents", 
      "elasticbeanstalk:RestartAppServer", 
      "elasticbeanstalk:RetrieveEnvironmentInfo", 
      "elasticbeanstalk:SwapEnvironmentCNAMEs", 
      "elasticbeanstalk:UpdateEnvironment", 
      "elasticbeanstalk:RequestEnvironmentInfo" 
     ], 
     "Resource":[ 
      "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:environment/ApplicationName/*" 
     ] 
     }, 
     { 
     "Sid":"ElasticBeanstalkGlobalPermissions", 
     "Effect":"Allow", 
     "Action":[ 
      "elasticbeanstalk:DescribeConfigurationOptions", 
      "elasticbeanstalk:DescribeConfigurationSettings", 
      "elasticbeanstalk:ListAvailableSolutionStacks", 
      "elasticbeanstalk:ValidateConfigurationSettings", 
      "elasticbeanstalk:CheckDNSAvailability", 
      "elasticbeanstalk:CreateStorageLocation" 
     ], 
     "Resource":[ 
      "*" 
     ] 
     }, 
     { 
     "Sid":"ElasticBeanstalkApplicationVersionPermissions", 
     "Effect":"Allow", 
     "Action":[ 
      "elasticbeanstalk:CreateApplicationVersion", 
      "elasticbeanstalk:DescribeApplicationVersions", 
      "elasticbeanstalk:UpdateApplicationVersion" 
     ], 
     "Resource":[ 
      "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:applicationversion/ApplicationName/*" 
     ] 
     }, 
     { 
     "Sid":"ElasticBeanstalkApplicationPermissions", 
     "Effect":"Allow", 
     "Action":[ 
      "elasticbeanstalk:DescribeApplications", 
      "elasticbeanstalk:UpdateApplication" 
     ], 
     "Resource":[ 
      "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:application/ApplicationName" 
     ] 
     }, 
     { 
     "Sid":"Autoscaling", 
     "Effect":"Allow", 
     "Action":[ 
      "autoscaling:SuspendProcesses", 
      "autoscaling:Describe*", 
      "autoscaling:ResumeProcesses" 
     ], 
     "Resource":"*" 
     }, 
     { 
     "Sid":"Cloudwatch", 
     "Effect":"Allow", 
     "Action":[ 
      "cloudwatch:Describe*", 
      "cloudwatch:GetMetricStatistics", 
      "cloudwatch:ListMetrics" 
     ], 
     "Resource":"*" 
     }, 
     { 
     "Sid":"Cloudformation", 
     "Effect":"Allow", 
     "Action":[ 
      "cloudformation:GetTemplate", 
      "cloudformation:Describe*" 
     ], 
     "Resource":"*" 
     }, 
     { 
     "Sid":"IAM", 
     "Effect":"Allow", 
     "Action":[ 
      "iam:ListServerCertificates", 
      "iam:ListInstanceProfiles" 
     ], 
     "Resource":"*" 
     }, 
     { 
     "Sid":"S3ElasticBeanstalkBucket", 
     "Action":[ 
      "s3:AbortMultipartUpload", 
      "s3:GetBucketAcl", 
      "s3:GetBucketCORS", 
      "s3:GetBucketLocation", 
      "s3:GetBucketLogging", 
      "s3:GetBucketNotification", 
      "s3:GetBucketPolicy", 
      "s3:GetBucketRequestPayment", 
      "s3:GetBucketTagging", 
      "s3:GetBucketVersioning", 
      "s3:GetBucketWebsite", 
      "s3:GetLifecycleConfiguration", 
      "s3:GetObject", 
      "s3:GetObjectAcl", 
      "s3:GetObjectTorrent", 
      "s3:GetObjectVersion", 
      "s3:GetObjectVersionAcl", 
      "s3:GetObjectVersionTorrent", 
      "s3:PutObject", 
      "s3:PutObjectAcl", 
      "s3:ListBucket", 
      "s3:GetObject", 
      "s3:DeleteObject" 
     ], 
     "Effect":"Allow", 
     "Resource":[ 
      "arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx", 
      "arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx/*" 
     ] 
     }, 
     { 
     "Sid":"S3Global", 
     "Effect":"Allow", 
     "Action":"s3:ListAllMyBuckets", 
     "Resource":"arn:aws:s3:::*" 
     }, 
     { 
     "Sid":"S3ElasticBeanstalkShared", 
     "Effect":"Allow", 
     "Action":"s3:*", 
     "Resource":[ 
      "arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1", 
      "arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1/*" 
     ] 
     }, 
     { 
     "Sid":"EC2Global", 
     "Effect":"Allow", 
     "Action":[ 
      "ec2:Describe*" 
     ], 
     "Resource":[ 
      "*" 
     ] 
     } 
    ] 
} 

La deuxième IAM gère la politique des instances EC2 pour un environnement donné:

{ 
    "Version":"2012-10-17", 
    "Statement":[ 
     { 
     "Sid":"EC2EnvironmentInstances", 
     "Effect":"Allow", 
     "Action":[ 
      "ec2:MonitorInstances", 
      "ec2:UnmonitorInstances", 
      "ec2:RebootInstances", 
      "ec2:StopInstances" 
     ], 
     "Resource":[ 
      "arn:aws:ec2:eu-west-1:123xxxxxxxxx:instance/*" 
     ], 
     "Condition":{ 
      "StringEquals":{ 
       "ec2:ResourceTag/elasticbeanstalk:environment-name":"EnvironmentName" 
      } 
     } 
     } 
    ] 
}