rdk-minimum-permissions.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "RdkPermissions",
            "Action": [
                "iam:Get*",
                "iam:List*",
                "lambda:AddPermission",
                "lambda:CreateFunction",
                "lambda:CreateEventSourceMapping",
                "lambda:UpdateFunctionConfiguration",
                "lambda:UpdateFunctionCode",
                "lambda:PublishVersion",
                "lambda:Get*",
                "lambda:List*",
                "config:Describe*",
                "config:Put*",
                "config:List*",
                "config:StartConfigurationRecorder",
                "config:Get*",
                "config:StartConfigRulesEvaluation",
                "cloudformation:*",
                "logs:Describe*",
                "logs:FilterLogEvents",
                "logs:GetLogEvents",
                "s3:List*",
                "s3:CreateBucket",
                "sts:GetCallerIdentity"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Sid": "RdkPermissionsS3",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::config-rule-code-bucket*"
        },
        {
            "Sid": "RdkPermissionsRolePolicyAttachment",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:PassRole"
            ],
            "Effect": "Allow",
            "Resource": ["arn:aws:iam::*:role/rdk/config-role"]
        },
        {
            "Sid": "RdkPermissionsPassRole",
            "Action": [
                "iam:CreateRole",
                "iam:PassRole",
                "iam:PutRolePolicy"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::*:role/rdk/*"
        }
    ]
}