Skip to content

Commit 6ef77fc

Browse files
johnculkinjohnculkin
committed
Updated READMEs
1 parent baa7ee1 commit 6ef77fc

File tree

51 files changed

+1401
-2
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1401
-2
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: ''
5+
labels: bug
6+
assignees: ''
7+
8+
---
9+
10+
**Describe the bug**
11+
A clear and concise description of what the bug is.
12+
13+
**To Reproduce**
14+
Steps to reproduce the behavior:
15+
1. Go to '...'
16+
2. Click on '....'
17+
3. Scroll down to '....'
18+
4. See error
19+
20+
**Expected behavior**
21+
A clear and concise description of what you expected to happen.
22+
23+
**Screenshots**
24+
If applicable, add screenshots to help explain your problem.
25+
26+
**Desktop (please complete the following information):**
27+
- OS: [e.g. iOS]
28+
- Browser [e.g. chrome, safari]
29+
- Version [e.g. 22]
30+
31+
**Additional context**
32+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/recipe-request.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Recipe request
3+
about: Suggest a recipe for this Chapter
4+
title: ''
5+
labels: enhancement
6+
assignees: ''
7+
8+
---
9+
10+
**Is your recipe request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
12+
13+
**Describe what you'd like to learn**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any other context or screenshots about the feature request here.

‎101-Creating-and-Assuming-an-IAM-Role/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
assume-role-policy.json

‎101-Creating-and-Assuming-an-IAM-Role/README.md

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Creating and Assuming an IAM Role for Developer Access
2+
## Clean up
3+
### Detach the PowerUserAccess policy from the role:
4+
```
5+
aws iam detach-role-policy --role-name AWSCookbook101Role \
6+
--policy-arn arn:aws:iam::aws:policy/PowerUserAccess
7+
```
8+
9+
### Delete the IAM role:
10+
11+
`aws iam delete-role --role-name AWSCookbook101Role`
12+
13+
### Unset your local variables:
14+
```
15+
unset ROLE_ARN
16+
unset PRINCIPAL_ARN
17+
```

‎101-Creating-and-Assuming-an-IAM-Role/assume-role-policy-template.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Principal": {
7+
"AWS": "PRINCIPAL_ARN"
8+
},
9+
"Action": "sts:AssumeRole"
10+
}
11+
]
12+
}

‎102-Generate-Least-Privilege-IAM-Policy/README.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Generate a Least Privilege IAM Policy Based on Access Patterns
2+
3+
## Clean up
4+
### Delete the IAM policy that you created

‎103-Enforcing-IAM-User-Password-Policies/README.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Enforcing IAM User Password Policies in Your AWS Account
2+
3+
## Clean up
4+
### Delete the login profiles that you created (including the validation step user):
5+
```
6+
aws iam delete-login-profile --user-name awscookbook103user
7+
aws iam delete-login-profile --user-name awscookbook103user2
8+
```
9+
10+
### Remove the user from the group:
11+
```
12+
aws iam remove-user-from-group --user-name awscookbook103user \
13+
--group-name AWSCookbook103Group
14+
```
15+
16+
### Detach the policy from the group:
17+
```
18+
aws iam detach-group-policy --group-name AWSCookbook103Group \
19+
--policy-arn arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess
20+
```
21+
22+
### Delete the group:
23+
`aws iam delete-group --group-name AWSCookbook103Group`
24+
25+
### Delete the users that you created (including the validation step user):
26+
```
27+
aws iam delete-user --user-name awscookbook103user
28+
aws iam delete-user --user-name awscookbook103user2
29+
```
30+
31+
### Delete the account password policy that you configured:
32+
`aws iam delete-account-password-policy`
33+
34+
### Unset the local variables you created:
35+
```
36+
unset RANDOM_STRING
37+
unset RANDOM_STRING2
38+
```

‎104-Testing-IAM-Policies-with-the-IAM-Policy-Simulator/README.md

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Testing IAM Policies with the IAM Policy Simulator
2+
3+
## Clean up
4+
### Step Text
5+
Detach the AmazonEC2ReadOnlyAccess policy from the role:
6+
```
7+
aws iam detach-role-policy --role-name AWSCookbook104IamRole \
8+
--policy-arn arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess
9+
```
10+
11+
Delete the IAM Role for the proxy:
12+
13+
`aws iam delete-role --role-name AWSCookbook104IamRole`

‎104-Testing-IAM-Policies-with-the-IAM-Policy-Simulator/assume-role-policy.json

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Principal": {
7+
"Service": "ec2.amazonaws.com"
8+
},
9+
"Action": "sts:AssumeRole"
10+
}
11+
]
12+
}
13+

‎105-Delegating-IAM-Administrative-Capabilities-Using-Permissions-Boundaries/.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
assume-role-policy.json
2+
policy.json
3+
boundary-policy.json

‎105-Delegating-IAM-Administrative-Capabilities-Using-Permissions-Boundaries/README.md

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Delegating IAM Administrative Capabilities Using Permissions Boundaries
2+
3+
## Clean up
4+
5+
### Unset the variables you set to assume the AWSCookbook105 role in your terminal:
6+
```
7+
unset AWS_ACCESS_KEY_ID
8+
unset AWS_SECRET_ACCESS_KEY
9+
unset AWS_SESSION_TOKEN
10+
```
11+
12+
### Detach the AmazonDynamoDBFullAccess and CloudWatchFullAccess policy from the role:
13+
```
14+
aws iam detach-role-policy --role-name AWSCookbook105test1 \
15+
--policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
16+
17+
aws iam detach-role-policy --role-name AWSCookbook105test1 \
18+
--policy-arn arn:aws:iam::aws:policy/CloudWatchFullAccess
19+
```
20+
21+
### Delete the IAM Role you used to test:
22+
```
23+
aws iam delete-role --role-name AWSCookbook105test1
24+
```
25+
26+
### Detach the Policy you created from the role:
27+
```
28+
aws iam detach-role-policy --role-name AWSCookbook105Role \
29+
--policy-arn arn:aws:iam::$AWS_ACCOUNT_ID:policy/AWSCookbook105Policy
30+
```
31+
32+
### Delete the policy:
33+
```
34+
aws iam delete-policy --policy-arn \
35+
arn:aws:iam::$AWS_ACCOUNT_ID:policy/AWSCookbook105Policy
36+
```
37+
38+
### Delete the permissions boundary:
39+
```
40+
aws iam delete-policy --policy-arn \
41+
arn:aws:iam::$AWS_ACCOUNT_ID:policy/AWSCookbook105PB
42+
```
43+
44+
### Delete the IAM Role:
45+
```
46+
aws iam delete-role --role-name AWSCookbook105Role
47+
```
48+
49+
### Unset the variables you set:
50+
```
51+
unset PRINCIPAL_ARN
52+
unset ROLE_ARN
53+
unset TEST_ROLE_1
54+
unset creds
55+
```
56+

‎105-Delegating-IAM-Administrative-Capabilities-Using-Permissions-Boundaries/assume-role-policy-template.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Principal": {
7+
"AWS": "PRINCIPAL_ARN"
8+
},
9+
"Action": "sts:AssumeRole"
10+
}
11+
]
12+
}

‎105-Delegating-IAM-Administrative-Capabilities-Using-Permissions-Boundaries/boundary-policy-template.json

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "CreateLogGroup",
6+
"Effect": "Allow",
7+
"Action": "logs:CreateLogGroup",
8+
"Resource": "arn:aws:logs:*:AWS_ACCOUNT_ID:*"
9+
},
10+
{
11+
"Sid": "CreateLogStreamandEvents",
12+
"Effect": "Allow",
13+
"Action": [
14+
"logs:CreateLogStream",
15+
"logs:PutLogEvents"
16+
],
17+
"Resource": "arn:aws:logs:*:AWS_ACCOUNT_ID:*"
18+
},
19+
{
20+
"Sid": "DynamoDBPermissions",
21+
"Effect": "Allow",
22+
"Action": [
23+
"dynamodb:PutItem",
24+
"dynamodb:UpdateItem",
25+
"dynamodb:DeleteItem"
26+
],
27+
"Resource": "arn:aws:dynamodb:*:AWS_ACCOUNT_ID:table/AWSCookbook*"
28+
},
29+
{
30+
"Sid": "S3Permissions",
31+
"Effect": "Allow",
32+
"Action": [
33+
"s3:GetObject",
34+
"s3:PutObject"
35+
],
36+
"Resource": "arn:aws:s3:::AWSCookbook*/*"
37+
}
38+
]
39+
}

‎105-Delegating-IAM-Administrative-Capabilities-Using-Permissions-Boundaries/lambda-assume-role-policy.json

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Principal": {
7+
"Service": "lambda.amazonaws.com"
8+
},
9+
"Action": "sts:AssumeRole"
10+
}
11+
]
12+
}
13+

‎105-Delegating-IAM-Administrative-Capabilities-Using-Permissions-Boundaries/lambda_function.py

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
import json
2+
import os
3+
import sys
4+
5+
def lambda_handler(event, context):
6+
7+
return {
8+
'statusCode': 200,
9+
'body': json.dumps('Hello AWSCookbook Reader!')
10+
}

‎105-Delegating-IAM-Administrative-Capabilities-Using-Permissions-Boundaries/policy-template.json

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "DenyPBDelete",
6+
"Effect": "Deny",
7+
"Action": "iam:DeleteRolePermissionsBoundary",
8+
"Resource": "*"
9+
},
10+
{
11+
"Sid": "IAMRead",
12+
"Effect": "Allow",
13+
"Action": [
14+
"iam:Get*",
15+
"iam:List*"
16+
],
17+
"Resource": "*"
18+
},
19+
{
20+
"Sid": "IAMPolicies",
21+
"Effect": "Allow",
22+
"Action": [
23+
"iam:CreatePolicy",
24+
"iam:DeletePolicy",
25+
"iam:CreatePolicyVersion",
26+
"iam:DeletePolicyVersion",
27+
"iam:SetDefaultPolicyVersion"
28+
],
29+
"Resource": "arn:aws:iam::AWS_ACCOUNT_ID:policy/AWSCookbook*"
30+
},
31+
{
32+
"Sid": "IAMRolesWithBoundary",
33+
"Effect": "Allow",
34+
"Action": [
35+
"iam:CreateRole",
36+
"iam:DeleteRole",
37+
"iam:PutRolePolicy",
38+
"iam:DeleteRolePolicy",
39+
"iam:AttachRolePolicy",
40+
"iam:DetachRolePolicy"
41+
],
42+
"Resource": [
43+
"arn:aws:iam::AWS_ACCOUNT_ID:role/AWSCookbook*"
44+
],
45+
"Condition": {
46+
"StringEquals": {
47+
"iam:PermissionsBoundary": "arn:aws:iam::AWS_ACCOUNT_ID:policy/AWSCookbook105PB"
48+
}
49+
}
50+
},
51+
{
52+
"Sid": "ServerlessFullAccess",
53+
"Effect": "Allow",
54+
"Action": [
55+
"lambda:*",
56+
"logs:*",
57+
"dynamodb:*",
58+
"s3:*"
59+
],
60+
"Resource": "*"
61+
},
62+
{
63+
"Sid": "PassRole",
64+
"Effect": "Allow",
65+
"Action": "iam:PassRole",
66+
"Resource": "arn:aws:iam::AWS_ACCOUNT_ID:role/AWSCookbook*",
67+
"Condition": {
68+
"StringLikeIfExists": {
69+
"iam:PassedToService": "lambda.amazonaws.com"
70+
}
71+
}
72+
},
73+
{
74+
"Sid": "ProtectPB",
75+
"Effect": "Deny",
76+
"Action": [
77+
"iam:CreatePolicyVersion",
78+
"iam:DeletePolicy",
79+
"iam:DeletePolicyVersion",
80+
"iam:SetDefaultPolicyVersion"
81+
],
82+
"Resource": [
83+
"arn:aws:iam::AWS_ACCOUNT_ID:policy/AWSCookbook105PB",
84+
"arn:aws:iam::AWS_ACCOUNT_ID:policy/AWSCookbook105Policy"
85+
]
86+
}
87+
]
88+
}

0 commit comments

Comments
 (0)