mirror of https://github.com/docker/docs.git
346 lines
14 KiB
Markdown
346 lines
14 KiB
Markdown
---
|
|
description: IAM permissions
|
|
keywords: aws iam permissions
|
|
title: Docker for AWS IAM permissions
|
|
---
|
|
|
|
The following IAM permissions are required to use Docker for AWS.
|
|
|
|
Before you deploy Docker for AWS, your account needs these permissions for the stack to deploy correctly.
|
|
If you create and use an IAM role with these permissions for creating the stack, CloudFormation uses the role's permissions instead of your own, using the AWS CloudFormation Service Role feature.
|
|
|
|
This feature is called [AWS CloudFormation Service Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html?icmpid=docs_cfn_console)
|
|
follow the link for more information.
|
|
|
|
{% raw %}
|
|
```none
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "Stmt1481924239005",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"cloudformation:CancelUpdateStack",
|
|
"cloudformation:ContinueUpdateRollback",
|
|
"cloudformation:CreateChangeSet",
|
|
"cloudformation:CreateStack",
|
|
"cloudformation:CreateUploadBucket",
|
|
"cloudformation:DeleteStack",
|
|
"cloudformation:DescribeAccountLimits",
|
|
"cloudformation:DescribeChangeSet",
|
|
"cloudformation:DescribeStackEvents",
|
|
"cloudformation:DescribeStackResource",
|
|
"cloudformation:DescribeStackResources",
|
|
"cloudformation:DescribeStacks",
|
|
"cloudformation:EstimateTemplateCost",
|
|
"cloudformation:ExecuteChangeSet",
|
|
"cloudformation:GetStackPolicy",
|
|
"cloudformation:GetTemplate",
|
|
"cloudformation:GetTemplateSummary",
|
|
"cloudformation:ListChangeSets",
|
|
"cloudformation:ListStackResources",
|
|
"cloudformation:ListStacks",
|
|
"cloudformation:PreviewStackUpdate",
|
|
"cloudformation:SetStackPolicy",
|
|
"cloudformation:SignalResource",
|
|
"cloudformation:UpdateStack",
|
|
"cloudformation:ValidateTemplate"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1481924344000",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"ec2:AllocateHosts",
|
|
"ec2:AssignPrivateIpAddresses",
|
|
"ec2:AssociateRouteTable",
|
|
"ec2:AttachInternetGateway",
|
|
"ec2:AttachNetworkInterface",
|
|
"ec2:AttachVolume",
|
|
"ec2:AuthorizeSecurityGroupEgress",
|
|
"ec2:AuthorizeSecurityGroupIngress",
|
|
"ec2:CreateInternetGateway",
|
|
"ec2:CreateNatGateway",
|
|
"ec2:CreateNetworkAcl",
|
|
"ec2:CreateNetworkAclEntry",
|
|
"ec2:CreateNetworkInterface",
|
|
"ec2:CreateRoute",
|
|
"ec2:CreateRouteTable",
|
|
"ec2:CreateSecurityGroup",
|
|
"ec2:CreateSubnet",
|
|
"ec2:CreateTags",
|
|
"ec2:CreateVolume",
|
|
"ec2:CreateVpc",
|
|
"ec2:DeleteInternetGateway",
|
|
"ec2:DeleteNatGateway",
|
|
"ec2:DeleteNetworkAcl",
|
|
"ec2:DeleteNetworkAclEntry",
|
|
"ec2:DeleteNetworkInterface",
|
|
"ec2:DeleteRoute",
|
|
"ec2:DeleteRouteTable",
|
|
"ec2:DeleteSecurityGroup",
|
|
"ec2:DeleteSubnet",
|
|
"ec2:DeleteTags",
|
|
"ec2:DeleteVolume",
|
|
"ec2:DeleteVpc",
|
|
"ec2:DescribeAccountAttributes",
|
|
"ec2:DescribeAvailabilityZones",
|
|
"ec2:DescribeHosts",
|
|
"ec2:DescribeImageAttribute",
|
|
"ec2:DescribeImages",
|
|
"ec2:DescribeInstanceStatus",
|
|
"ec2:DescribeInstances",
|
|
"ec2:DescribeInternetGateways",
|
|
"ec2:DescribeKeyPairs",
|
|
"ec2:DescribeNetworkInterfaces",
|
|
"ec2:DescribeRegions",
|
|
"ec2:DescribeRouteTables",
|
|
"ec2:DescribeSecurityGroups",
|
|
"ec2:DescribeSubnets",
|
|
"ec2:DescribeTags",
|
|
"ec2:DescribeVolumeAttribute",
|
|
"ec2:DescribeVolumeStatus",
|
|
"ec2:DescribeVolumes",
|
|
"ec2:DescribeVpcAttribute",
|
|
"ec2:DescribeVpcs",
|
|
"ec2:DetachInternetGateway",
|
|
"ec2:DetachNetworkInterface",
|
|
"ec2:DetachVolume",
|
|
"ec2:DisassociateAddress",
|
|
"ec2:DisassociateRouteTable",
|
|
"ec2:GetConsoleOutput",
|
|
"ec2:GetConsoleScreenshot",
|
|
"ec2:ImportKeyPair",
|
|
"ec2:ModifyNetworkInterfaceAttribute",
|
|
"ec2:ModifyVpcAttribute",
|
|
"ec2:ModifySubnetAttribute",
|
|
"ec2:RebootInstances",
|
|
"ec2:ReleaseAddress",
|
|
"ec2:ReleaseHosts",
|
|
"ec2:RevokeSecurityGroupEgress",
|
|
"ec2:RevokeSecurityGroupIngress",
|
|
"ec2:RunInstances",
|
|
"ec2:StartInstances",
|
|
"ec2:StopInstances",
|
|
"ec2:TerminateInstances"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1481924651000",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"autoscaling:AttachInstances",
|
|
"autoscaling:AttachLoadBalancers",
|
|
"autoscaling:CompleteLifecycleAction",
|
|
"autoscaling:CreateAutoScalingGroup",
|
|
"autoscaling:CreateLaunchConfiguration",
|
|
"autoscaling:CreateOrUpdateTags",
|
|
"autoscaling:DeleteAutoScalingGroup",
|
|
"autoscaling:DeleteLaunchConfiguration",
|
|
"autoscaling:DeleteLifecycleHook",
|
|
"autoscaling:DeleteNotificationConfiguration",
|
|
"autoscaling:DeletePolicy",
|
|
"autoscaling:DeleteScheduledAction",
|
|
"autoscaling:DeleteTags",
|
|
"autoscaling:DescribeAccountLimits",
|
|
"autoscaling:DescribeAutoScalingGroups",
|
|
"autoscaling:DescribeAutoScalingInstances",
|
|
"autoscaling:DescribeAutoScalingNotificationTypes",
|
|
"autoscaling:DescribeLaunchConfigurations",
|
|
"autoscaling:DescribeLifecycleHookTypes",
|
|
"autoscaling:DescribeLifecycleHooks",
|
|
"autoscaling:DescribeLoadBalancers",
|
|
"autoscaling:DescribeScalingActivities",
|
|
"autoscaling:DescribeScheduledActions",
|
|
"autoscaling:DescribeTags",
|
|
"autoscaling:DetachInstances",
|
|
"autoscaling:DetachLoadBalancers",
|
|
"autoscaling:DisableMetricsCollection",
|
|
"autoscaling:EnableMetricsCollection",
|
|
"autoscaling:EnterStandby",
|
|
"autoscaling:ExecutePolicy",
|
|
"autoscaling:ExitStandby",
|
|
"autoscaling:PutLifecycleHook",
|
|
"autoscaling:PutNotificationConfiguration",
|
|
"autoscaling:PutScalingPolicy",
|
|
"autoscaling:PutScheduledUpdateGroupAction",
|
|
"autoscaling:RecordLifecycleActionHeartbeat",
|
|
"autoscaling:ResumeProcesses",
|
|
"autoscaling:SetDesiredCapacity",
|
|
"autoscaling:SetInstanceHealth",
|
|
"autoscaling:SetInstanceProtection",
|
|
"autoscaling:SuspendProcesses",
|
|
"autoscaling:TerminateInstanceInAutoScalingGroup",
|
|
"autoscaling:UpdateAutoScalingGroup"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1481924759004",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"dynamodb:CreateTable",
|
|
"dynamodb:DeleteItem",
|
|
"dynamodb:DeleteTable",
|
|
"dynamodb:DescribeTable",
|
|
"dynamodb:GetItem",
|
|
"dynamodb:ListTables",
|
|
"dynamodb:PutItem",
|
|
"dynamodb:Query",
|
|
"dynamodb:UpdateItem",
|
|
"dynamodb:UpdateTable"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1481924854000",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"logs:CreateLogGroup",
|
|
"logs:CreateLogStream",
|
|
"logs:DeleteLogGroup",
|
|
"logs:DeleteLogStream",
|
|
"logs:DescribeLogGroups",
|
|
"logs:GetLogEvents",
|
|
"logs:PutLogEvents",
|
|
"logs:PutRetentionPolicy"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1481924989003",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"sqs:ChangeMessageVisibility",
|
|
"sqs:CreateQueue",
|
|
"sqs:DeleteMessage",
|
|
"sqs:DeleteQueue",
|
|
"sqs:GetQueueAttributes",
|
|
"sqs:GetQueueUrl",
|
|
"sqs:ListQueues",
|
|
"sqs:ReceiveMessage",
|
|
"sqs:SendMessage",
|
|
"sqs:SetQueueAttributes"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1481924989002",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"iam:AddRoleToInstanceProfile",
|
|
"iam:CreateInstanceProfile",
|
|
"iam:CreateRole",
|
|
"iam:DeleteInstanceProfile",
|
|
"iam:DeleteRole",
|
|
"iam:DeleteRolePolicy",
|
|
"iam:GetRole",
|
|
"iam:PassRole",
|
|
"iam:PutRolePolicy",
|
|
"iam:RemoveRoleFromInstanceProfile"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1481924989001",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticloadbalancing:AddTags",
|
|
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
|
|
"elasticloadbalancing:AttachLoadBalancerToSubnets",
|
|
"elasticloadbalancing:ConfigureHealthCheck",
|
|
"elasticloadbalancing:CreateListener",
|
|
"elasticloadbalancing:CreateLoadBalancer",
|
|
"elasticloadbalancing:CreateLoadBalancerListeners",
|
|
"elasticloadbalancing:CreateLoadBalancerPolicy",
|
|
"elasticloadbalancing:CreateRule",
|
|
"elasticloadbalancing:CreateTargetGroup",
|
|
"elasticloadbalancing:DeleteListener",
|
|
"elasticloadbalancing:DeleteLoadBalancer",
|
|
"elasticloadbalancing:DeleteLoadBalancerListeners",
|
|
"elasticloadbalancing:DeleteLoadBalancerPolicy",
|
|
"elasticloadbalancing:DeleteRule",
|
|
"elasticloadbalancing:DeleteTargetGroup",
|
|
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
|
|
"elasticloadbalancing:DeregisterTargets",
|
|
"elasticloadbalancing:DescribeInstanceHealth",
|
|
"elasticloadbalancing:DescribeListeners",
|
|
"elasticloadbalancing:DescribeLoadBalancerAttributes",
|
|
"elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
|
|
"elasticloadbalancing:DescribeLoadBalancerPolicies",
|
|
"elasticloadbalancing:DescribeLoadBalancers",
|
|
"elasticloadbalancing:DescribeRules",
|
|
"elasticloadbalancing:DescribeSSLPolicies",
|
|
"elasticloadbalancing:DescribeTags",
|
|
"elasticloadbalancing:DescribeTargetGroupAttributes",
|
|
"elasticloadbalancing:DescribeTargetGroups",
|
|
"elasticloadbalancing:DescribeTargetHealth",
|
|
"elasticloadbalancing:DetachLoadBalancerFromSubnets",
|
|
"elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer",
|
|
"elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer",
|
|
"elasticloadbalancing:ModifyListener",
|
|
"elasticloadbalancing:ModifyLoadBalancerAttributes",
|
|
"elasticloadbalancing:ModifyRule",
|
|
"elasticloadbalancing:ModifyTargetGroup",
|
|
"elasticloadbalancing:ModifyTargetGroupAttributes",
|
|
"elasticloadbalancing:RegisterTargets",
|
|
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
|
|
"elasticloadbalancing:RemoveTags",
|
|
"elasticloadbalancing:SetLoadBalancerListenerSSLCertificate",
|
|
"elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
|
|
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
|
|
"elasticloadbalancing:SetRulePriorities",
|
|
"elasticloadbalancing:SetSecurityGroups",
|
|
"elasticloadbalancing:SetSubnets"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1487169681000",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"elasticfilesystem:*"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "Stmt1487169681009",
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"lambda:CreateFunction",
|
|
"lambda:DeleteFunction",
|
|
"lambda:GetFunctionConfiguration",
|
|
"lambda:InvokeFunction",
|
|
"lambda:UpdateFunctionCode",
|
|
"lambda:UpdateFunctionConfiguration"
|
|
],
|
|
"Resource": [
|
|
"*"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
{% endraw %}
|