0

I'm trying to setup an AWS IAM policy to create MediaLive inputs.

I'm running this through the simulator

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "medialive:CreateInput",
            "Resource": [
                "arn:aws:medialive:us-west-2:XXXXXXXXXXXX:input:*"
            ]
        }
    ]
}

and I get Implicitly denied (no matching statements). error.

Of course that, if I try to use the following policy, I get successful in the simulation, but this is not a good implementation because of the wide range of resources.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "medialive:CreateInput",
            "Resource": "*"
        }
    ]
}

I've also tried to include "arn:aws:medialive:us-west-2:XXXXXXXXXXXX:inputSecurityGroup:*" and "arn:aws:medialive:us-west-2:XXXXXXXXXXXX:channel:*" next to the already existing resource, but I still get the error message.

Any suggestion?

kord
  • 979
  • 14
  • 24

1 Answers1

0

You will need to Specify input-security-group resource ARN for the CreateInput action, in order to have the simulation to succeed.

Can you please confirm if you have used the following syntax or similar when testing it through the aws IAM Policy simulator

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "medialive:CreateInput",
            "Resource": [
                "arn:aws:medialive:us-west-2:XXXXXXX:input:*",
                "arn:aws:medialive:*:XXXXXXXX:inputSecurityGroup:*"
            ]
        }
    ]
}

NOTE: User used for simulating this IAM Policy needs to have appropriate role/rights to create MediaLive resources. MediaLive UserGuide has detailed steps on how to create it.

Hussain Mohammed
  • 46
  • 3
  • Yes, I confirm I tried your suggestion and it does not work. – kord Oct 21 '20 at 01:18
  • Looks like the user that you are using to simulate the IAM policy does not have MediaLive Access/Rights. – Hussain Mohammed Oct 22 '20 at 21:26
  • User you are using for this simulation needs to have the rights to create EML resources. Please follow the MediaLive UserGuide to create this policy as per your requirement. [Page 11 onwards] https://docs.aws.amazon.com/medialive/latest/ug/medialive-ug.pdf – Hussain Mohammed Oct 22 '20 at 21:32