Package: cfngiam
cfn-giamAutomatically generate the required IAM policies from your Cloudformation fileManual procedureOpen AWS Cloudshell or any terminal configured with aws cli.Install cfn-giampip3installcfngiamCheck the IAM Policy required to execute the cloudformation file or foldercfn-giam-i$yourcfn-o$exportfoldercli optionsCLI optionDescriptionRequire-i, --input-pathCloudformation file, folder or url path having Cloudformation files.   Supported yaml and json. If this path is a folder, it will be detected   recursively.yes or -l-l, --input-resouce-type-listAWS Resouce type name list of comma-separated strings. e.g.   "AWS::IAM::Role,AWS::VPC::EC2"yes or -i-o, --output-folderpathOutput IAM policy files root folder.If not specified, it matches the   input-path. Moreover, if input-path is not specified, it will be output to   the current directory.no-p, --policySet the name of the IAM Policy to be created on AWS.no-r, --roleSet the name of the IAM Role to be created on AWS.no-v, --versionShow version information and quit.no-V, --verbosegive more detailed outputno--helpShow a help synopsis and quit.nocli examplesCloudformation filecfn-giam-i./CFn/example.ymlcfn-giam generates to "./CFn/example.json"Cloudformation foldercfn-giam-i./CFn-o./distcfn-giam generates to "./dist/CFn/example.json"
cfn-giam generates to "./dist/MasterPolicy.json"Cloudformation url filecfn-giam-ihttps://s3.ap-northeast-1.amazonaws.com/cloudformation-templates-ap-northeast-1/Windows_Single_Server_SharePoint_Foundation.templatecfn-giam generates to "./Windows_Single_Server_SharePoint_Foundation.json"Cloudformation resouce type listcfn-giam-lAWS::EC2::Instance,AWS::EC2::SecurityGroup,AWS::EC2::Instancecfn-giam generates to "./Windows_Single_Server_SharePoint_Foundation.json"Automatical procedure1. Fork to your Github account from this repositoryFork a repo2. Create IAM Role and IAM ID Provider for Github ActionsOpen Cloudformation on your AWS Account.Create stack fromGithubOIDCRole-ReadOnly.yml.Make a note the Roke-Arn created from stack and region's name having stack.3. Register Role-Arn and region name to Github sercretsView Github Actions page on your repository.Register following list to Github secrets.NAME: AWS_REGION, VALUE: your region's name having stackNAME: ROLE_ARN, VALUE: your Roke-Arn created from stack4. Commit and Push your Cloudformation fileAdd your Cloudformation file inCFnfolder.Commit and Push your repository.5. Check artifacts on Github ActionsView Github Actions page on your repository.Make sure the latest "Check the IAM Policy workflow" is successful.Open the latest workflow.Download artifact on the latest workflow.OthersGithub Actions thumbprintGithub Actions thumbprint changes from time to time.e.g.ChangelogIn that case, Update toGithubOIDCRole-ReadOnly.ymlafter get new thumbprint withGetGithubOIDCThumbprint.sh.shGetGithubOIDCThumbprint.shNot support Resouce typesNot support Resource typesAWS::AmazonMQ::BrokerAWS::AmazonMQ::ConfigurationAWS::AmazonMQ::ConfigurationAssociationAWS::ApiGateway::DocumentationPartAWS::ApiGateway::RestApiAWS::ApiGateway::VpcLinkAWS::ApiGatewayV2::ApiAWS::ApiGatewayV2::ApiGatewayManagedOverridesAWS::ApiGatewayV2::ApiMappingAWS::ApiGatewayV2::AuthorizerAWS::ApiGatewayV2::DeploymentAWS::ApiGatewayV2::DomainNameAWS::ApiGatewayV2::IntegrationAWS::ApiGatewayV2::IntegrationResponseAWS::ApiGatewayV2::ModelAWS::ApiGatewayV2::RouteAWS::ApiGatewayV2::RouteResponseAWS::ApiGatewayV2::StageAWS::ApiGatewayV2::VpcLinkAWS::AppConfig::ApplicationAWS::AppConfig::ConfigurationProfileAWS::AppConfig::DeploymentAWS::AppConfig::DeploymentStrategyAWS::AppConfig::EnvironmentAWS::AppConfig::HostedConfigurationVersionAWS::AppMesh::GatewayRouteAWS::AppMesh::MeshAWS::AppMesh::RouteAWS::AppMesh::VirtualGatewayAWS::AppMesh::VirtualNodeAWS::AppMesh::VirtualRouterAWS::AppMesh::VirtualServiceAWS::AppStream::DirectoryConfigAWS::AppStream::FleetAWS::AppStream::ImageBuilderAWS::AppStream::StackAWS::AppStream::StackFleetAssociationAWS::AppStream::StackUserAssociationAWS::AppStream::UserAWS::AppSync::ApiCacheAWS::AppSync::ApiKeyAWS::AppSync::DataSourceAWS::AppSync::FunctionConfigurationAWS::AppSync::GraphQLApiAWS::AppSync::GraphQLSchemaAWS::AppSync::ResolverAWS::ApplicationAutoScaling::ScalableTargetAWS::ApplicationAutoScaling::ScalingPolicyAWS::AutoScaling::AutoScalingGroupAWS::AutoScaling::ScalingPolicyAWS::AutoScaling::ScheduledActionAWS::AutoScalingPlans::ScalingPlanAWS::Batch::JobDefinitionAWS::Budgets::BudgetAWS::CertificateManager::CertificateAWS::Cloud9::EnvironmentEC2AWS::CloudFormation::CustomResourceAWS::CloudFormation::MacroAWS::CloudFormation::StackAWS::CloudFormation::WaitConditionAWS::CloudFormation::WaitConditionHandleAWS::CloudFront::StreamingDistributionAWS::CloudWatch::AlarmAWS::CloudWatch::AnomalyDetectorAWS::CloudWatch::DashboardAWS::CloudWatch::InsightRuleAWS::CodeBuild::ProjectAWS::CodeBuild::ReportGroupAWS::CodeBuild::SourceCredentialAWS::CodeCommit::RepositoryAWS::CodeDeploy::ApplicationAWS::CodeDeploy::DeploymentConfigAWS::CodeDeploy::DeploymentGroupAWS::CodePipeline::CustomActionTypeAWS::CodePipeline::PipelineAWS::CodePipeline::WebhookAWS::CodeStar::GitHubRepositoryAWS::Cognito::IdentityPoolAWS::Cognito::IdentityPoolRoleAttachmentAWS::Cognito::UserPoolAWS::Cognito::UserPoolClientAWS::Cognito::UserPoolDomainAWS::Cognito::UserPoolGroupAWS::Cognito::UserPoolIdentityProviderAWS::Cognito::UserPoolResourceServerAWS::Cognito::UserPoolRiskConfigurationAttachmentAWS::Cognito::UserPoolUICustomizationAttachmentAWS::Cognito::UserPoolUserAWS::Cognito::UserPoolUserToGroupAttachmentAWS::Config::ConfigRuleAWS::Config::ConfigurationRecorderAWS::Config::DeliveryChannelAWS::Config::OrganizationConfigRuleAWS::Config::RemediationConfigurationAWS::DAX::ClusterAWS::DAX::ParameterGroupAWS::DAX::SubnetGroupAWS::DLM::LifecyclePolicyAWS::DMS::CertificateAWS::DMS::EndpointAWS::DMS::EventSubscriptionAWS::DMS::ReplicationInstanceAWS::DMS::ReplicationSubnetGroupAWS::DMS::ReplicationTask