0

While developing a CloudFormation template, I am following the principle of least privilege. So I am providing CloudFormation a role to assume, and which has the minimal set of privileges.

The template contains an AWS::AutoScaling::AutoScalingGroup which is based on a AWS::EC2::LaunchTemplate:

ECSAutoScalingGroup:
  DependsOn: ECSCluster
  Type: AWS::AutoScaling::AutoScalingGroup
  Properties:
    VPCZoneIdentifier: !Ref Subnets
    LaunchTemplate:
      LaunchTemplateId: !Ref ECSLaunchTemplate
      Version: !GetAtt ECSLaunchTemplate.LatestVersionNumber
    MinSize: 1
    MaxSize: 2
    DesiredCapacity: 1
    ...

ECSLaunchTemplate:
  Type: AWS::EC2::LaunchTemplate
  Metadata:
    AWS::CloudFormation::Init:
    ...
  Properties:
    LaunchTemplateName: test-template
    LaunchTemplateData:
       ...

When I create a CloudFormation stack out of this template, I get the following error on the ECSAutoScalingGroup resource:

Failed to retrieve attribute [LatestVersionNumber] for resource [ECSLaunchTemplate]: You are not authorized to perform this operation. (Service: AmazonEC2; Status Code: 403; Error Code: UnauthorizedOperation; Request ID: e0f01fd0-ee2a-4260-94f4-3c65177d05ee; Proxy: null)

Which IAM policy should I add to the IAM Role which is assumed by CloudFormation? Clearly, if I give it AdministratorAccess, it succeeds. However, I would like to follow the principal of least privilege.

Any ideas? Thanks.

maslick
  • 2,903
  • 3
  • 28
  • 50

1 Answers1

2

Answering my own question here. One should add these 2 actions to their IAM Role policy:

  • ec2:DescribeLaunchTemplates
  • ec2:DescribeLaunchTemplateVersions
maslick
  • 2,903
  • 3
  • 28
  • 50