Redistribute ECR policies and clean up policy files

aws/policy/application-security.yaml

@@ -5,37 +5,37 @@ Statement:
     Effect: Allow
     Action:
       - wafv2:AssociateWebACL
-      - wafv2:DeleteRuleGroup
+      - wafv2:CheckCapacity
+      - wafv2:CreateIPSet
       - wafv2:CreateRuleGroup
-      - wafv2:PutFirewallManagerRuleGroups
-      - wafv2:DeleteWebACL
       - wafv2:CreateWebACL
-      - wafv2:CreateIPSet
+      - wafv2:DeleteFirewallManagerRuleGroups
       - wafv2:DeleteIPSet
-      - wafv2:CheckCapacity
       - wafv2:DeleteLoggingConfiguration
-      - wafv2:PutLoggingConfiguration
-      - wafv2:DisassociateWebACL
-      - wafv2:UpdateWebACL
-      - wafv2:UpdateRuleGroup
-      - wafv2:DeleteFirewallManagerRuleGroups
+      - wafv2:DeleteRuleGroup
+      - wafv2:DeleteWebACL
       - wafv2:DisassociateFirewallManager
+      - wafv2:DisassociateWebACL
+      - wafv2:PutFirewallManagerRuleGroups
+      - wafv2:PutLoggingConfiguration
       - wafv2:UpdateIPSet
+      - wafv2:UpdateRuleGroup
+      - wafv2:UpdateWebACL
     Resource:
       - 'arn:aws:wafv2:{{ aws_region }}:{{ aws_account_id }}:*'
 
   - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurNoFees
     Effect: Allow
     Action:
-      - inspector:List*
-      - inspector:CreateResourceGroup
       - inspector:CreateAssessmentTarget
-      - inspector:Describe*
-      - inspector:UpdateAssessmentTarget
-      - inspector:DeleteAssessmentTarget
       - inspector:CreateAssessmentTemplate
+      - inspector:CreateResourceGroup
+      - inspector:DeleteAssessmentTarget
       - inspector:DeleteAssessmentTemplate
+      - inspector:Describe*
+      - inspector:List*
       - inspector:SetTagsForResource
+      - inspector:UpdateAssessmentTarget
       - waf:CreateByteMatchSet
       - waf:CreateGeoMatchSet
       - waf:CreateIPSet

aws/policy/application-services.yaml

@@ -33,7 +33,6 @@ Statement:
       - events:PutRule
       - events:PutTargets
       - events:RemoveTargets
-      - glue:Get*
       - kinesis:Describe*
       - kinesis:List*
       - mq:Describe*
@@ -87,8 +86,6 @@ Statement:
   - Sid: AllowGlobalResourceRestrictedActionsWhichIncurNoFees
     Effect: Allow
     Action:
-      - ssm:CreateDocument
-      - ssm:DeleteDocument
       - cloudformation:CreateChangeSet
       - cloudformation:CreateStack
       - cloudformation:DeleteChangeSet
@@ -120,19 +117,20 @@ Statement:
       - mq:CreateTags
       - SNS:CreateTopic
       - SNS:DeleteTopic
-      - SNS:TagResource
       - SNS:SetSubscriptionAttributes
       - SNS:SetTopicAttributes
       - SNS:Subscribe
+      - SNS:TagResource
       - SNS:Unsubscribe
       - SNS:UntagResource
+      - ssm:CreateDocument
+      - ssm:DeleteDocument
       - ssm:DeleteParameter
       - ssm:PutParameter
       - states:DeleteStateMachine
       - states:TagResource
       - states:UntagResource
     Resource:
-      - 'arn:aws:ssm:{{ aws_region }}:{{ aws_account_id }}:document/*'
       - 'arn:aws:cloudformation:{{ aws_region }}:{{ aws_account_id }}:stack/*'
       - 'arn:aws:cloudwatch:{{ aws_region }}:{{ aws_account_id }}:alarm:*'
       - 'arn:aws:codebuild:{{ aws_region }}:{{ aws_account_id }}:*'
@@ -143,6 +141,7 @@ Statement:
       - 'arn:aws:kinesis:{{ aws_region }}:{{ aws_account_id }}:stream/*'
       - 'arn:aws:mq:{{ aws_region }}:{{ aws_account_id }}:*'
       - 'arn:aws:sns:{{ aws_region }}:{{ aws_account_id }}:*'
+      - 'arn:aws:ssm:{{ aws_region }}:{{ aws_account_id }}:document/*'
       - 'arn:aws:ssm:{{ aws_region }}:{{ aws_account_id }}:parameter/*'
       - 'arn:aws:ssm:{{ aws_region }}::parameter/aws/service/*'
       - 'arn:aws:states:{{ aws_region }}:{{ aws_account_id }}:*'
@@ -165,12 +164,12 @@ Statement:
       - states:StopExecution
       - states:UpdateStateMachine
     Resource:
-      - 'arn:aws:sns:{{ aws_region }}:{{ aws_account_id }}:*'
-      - 'arn:aws:states:{{ aws_region }}:{{ aws_account_id }}:*'
-      - 'arn:aws:mq:{{ aws_region }}:{{ aws_account_id }}:*'
-      - 'arn:aws:kinesis:{{ aws_region }}:{{ aws_account_id }}:stream/*'
       - 'arn:aws:glue:{{ aws_region }}:{{ aws_account_id }}:crawler/*'
       - 'arn:aws:glue:{{ aws_region }}:{{ aws_account_id }}:job/*'
+      - 'arn:aws:kinesis:{{ aws_region }}:{{ aws_account_id }}:stream/*'
+      - 'arn:aws:mq:{{ aws_region }}:{{ aws_account_id }}:*'
+      - 'arn:aws:sns:{{ aws_region }}:{{ aws_account_id }}:*'
+      - 'arn:aws:states:{{ aws_region }}:{{ aws_account_id }}:*'
 
   # Used to test some of the cross-account features
   - Sid: PermitReadOnlyThirdParty

aws/policy/compute.yaml

@@ -9,8 +9,8 @@ Statement:
       - autoscaling:AttachInstances
       - autoscaling:CreateAutoScalingGroup
       - autoscaling:CreateLaunchConfiguration
-      - autoscaling:UpdateAutoScalingGroup
       - autoscaling:DetachInstances
+      - autoscaling:UpdateAutoScalingGroup
       - ec2:RunInstances
       - ec2:StartInstances
     Resource:
@@ -114,13 +114,13 @@ Statement:
       - autoscaling:ResumeProcesses
       - autoscaling:SuspendProcesses
       - ec2:Describe*
-      - elasticloadbalancing:DeleteRule
       - elasticloadbalancing:DeleteListener
-      - elasticloadbalancing:Describe*
+      - elasticloadbalancing:DeleteRule
       - elasticloadbalancing:DeregisterTargets
+      - elasticloadbalancing:Describe*
       - elasticloadbalancing:ModifyListener
-      - elasticloadbalancing:ModifyTargetGroupAttributes
       - elasticloadbalancing:ModifyRule
+      - elasticloadbalancing:ModifyTargetGroupAttributes
       - elasticloadbalancing:SetIpAddressType
       - elasticloadbalancing:SetRulePriorities
     Resource:
@@ -146,15 +146,15 @@ Statement:
       - autoscaling:CompleteLifecycleAction
       - autoscaling:CreateOrUpdateTags
       - autoscaling:Delete*
-      - autoscaling:DetachLoadBalancers
       - autoscaling:DetachLoadBalancerTargetGroups
+      - autoscaling:DetachLoadBalancers
       - autoscaling:DisableMetricsCollection
+      - autoscaling:PutLifecycleHook
       - autoscaling:PutScalingPolicy
       - autoscaling:PutScheduledUpdateGroupAction
-      - autoscaling:PutLifecycleHook
-      - autoscaling:StartInstanceRefresh
       - autoscaling:SetInstanceHealth
       - autoscaling:SetInstanceProtection
+      - autoscaling:StartInstanceRefresh
       - autoscaling:TerminateInstanceInAutoScalingGroup
       - ec2:DeleteVolume
       - elasticloadbalancing:AddListenerCertificates
@@ -172,9 +172,9 @@ Statement:
       - elasticloadbalancing:DisableAvailabilityZonesForLoadBalancer
       - elasticloadbalancing:EnableAvailabilityZonesForLoadBalancer
       - elasticloadbalancing:ModifyLoadBalancerAttributes
-      - elasticloadbalancing:RemoveTags
       - elasticloadbalancing:RegisterInstancesWithLoadBalancer
       - elasticloadbalancing:RegisterTargets
+      - elasticloadbalancing:RemoveTags
       - elasticloadbalancing:SetLoadBalancer*
       - elasticloadbalancing:SetSecurityGroups
       - elasticloadbalancing:SetWebACL

aws/policy/data-services.yaml

@@ -6,17 +6,17 @@ Statement:
       - dms:CreateEndpoint
       - dms:Describe*
       - dms:List*
-      - dynamodb:Get*
       - dynamodb:Describe*
+      - dynamodb:Get*
       - dynamodb:List*
       - dynamodb:Query
       - dynamodb:Scan
       - elasticache:Describe*
       - elasticache:List*
       - glacier:List*
-      - glue:Get*
       - glue:CreateConnection
       - glue:DeleteConnection
+      - glue:Get*
       - glue:UpdateConnection
       - rds:Describe*
       - rds:List*
@@ -51,93 +51,92 @@ Statement:
       - elasticache:ModifyCacheParameterGroup
       - elasticache:ModifyCacheSubnetGroup
       - elasticache:RemoveTagsFromResource
+      - glacier:AddTagsToVault
       - glacier:CreateVault
       - glacier:DeleteVault
-      - glacier:AddTagsToVault
       - glacier:RemoveTagsFromVault
-      - redshift:CreateClusterSubnetGroup
-      - redshift:CreateTags
-      - redshift:DeleteCluster
-      - redshift:DeleteClusterSubnetGroup
-      - redshift:DeleteTags
-      - redshift:ModifyCluster
-      - redshift:ModifyClusterSubnetGroup
-      - redshift:RebootCluster
       - rds:AddTagsToResource
-      - rds:CreateDBParameterGroup
+      - rds:CancelExportTask
+      - rds:CopyDBClusterSnapshot
+      - rds:CopyDBSnapshot
       - rds:CreateDBClusterParameterGroup
+      - rds:CreateDBClusterSnapshot
+      - rds:CreateDBInstance
+      - rds:CreateDBInstanceReadReplica
+      - rds:CreateDBParameterGroup
+      - rds:CreateDBSnapshot
       - rds:CreateDBSubnetGroup
+      - rds:CreateOptionGroup
       - rds:DeleteDBCluster
-      - rds:DeleteDBParameterGroup
       - rds:DeleteDBClusterParameterGroup
+      - rds:DeleteDBClusterSnapshot
+      - rds:DeleteDBInstance
+      - rds:DeleteDBParameterGroup
+      - rds:DeleteDBSnapshot
       - rds:DeleteDBSubnetGroup
-      - rds:RestoreDBInstanceToPointInTime
-      - rds:RestoreDBInstanceFromDBSnapshot
-      - rds:RestoreDBInstanceFromS3
-      - rds:CreateDBInstanceReadReplica
-      - rds:CreateDBInstance
+      - rds:DeleteOptionGroup
+      - rds:ModifyDBCluster
+      - rds:ModifyDBClusterParameterGroup
       - rds:ModifyDBInstance
-      - rds:DeleteDBInstance
-      - rds:StopDBCluster
-      - rds:StopDBInstance
-      - rds:StartDBCluster
-      - rds:StartDBInstance
+      - rds:ModifyDBParameterGroup
+      - rds:ModifyDBSubnetGroup
+      - rds:ModifyOptionGroup
       - rds:PromoteReadReplica
+      - rds:PromoteReadReplicaDBCluster
       - rds:RebootDBCluster
       - rds:RebootDBInstance
-      - rds:ModifyDBCluster
-      - rds:ModifyDBParameterGroup
-      - rds:ModifyDBClusterParameterGroup
-      - rds:ModifyDBSubnetGroup
       - rds:RemoveTagsFromResource
-      - rds:CreateOptionGroup
-      - rds:ModifyOptionGroup
-      - rds:DeleteOptionGroup
-      - rds:CreateDBClusterSnapshot
-      - rds:DeleteDBClusterSnapshot
-      - rds:CreateDBSnapshot
-      - rds:DeleteDBSnapshot
-      - rds:CopyDBSnapshot
-      - rds:StartExportTask
-      - rds:CancelExportTask
-      - rds:RestoreDBClusterToPointInTime
-      - rds:RestoreDBClusterFromSnapshot
       - rds:RestoreDBClusterFromS3
-      - rds:PromoteReadReplicaDBCluster
-      - rds:CopyDBClusterSnapshot
+      - rds:RestoreDBClusterFromSnapshot
+      - rds:RestoreDBClusterToPointInTime
+      - rds:RestoreDBInstanceFromDBSnapshot
+      - rds:RestoreDBInstanceFromS3
+      - rds:RestoreDBInstanceToPointInTime
+      - rds:StartDBCluster
+      - rds:StartDBInstance
+      - rds:StartExportTask
+      - rds:StopDBCluster
+      - rds:StopDBInstance
+      - redshift:CreateClusterSubnetGroup
+      - redshift:CreateTags
+      - redshift:DeleteCluster
+      - redshift:DeleteClusterSubnetGroup
+      - redshift:DeleteTags
+      - redshift:ModifyCluster
+      - redshift:ModifyClusterSubnetGroup
+      - redshift:RebootCluster
     Resource:
       - 'arn:aws:dms:{{ aws_region }}:{{ aws_account_id }}:endpoint:*'
       - 'arn:aws:dms:{{ aws_region }}:{{ aws_account_id }}:subgrp:*'
       - 'arn:aws:dynamodb:{{ aws_region }}:{{ aws_account_id }}:table/*'
       - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
-      - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:subnetgroup:*'
       - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:parametergroup:*'
       - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:securitygroup:*'
+      - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:subnetgroup:*'
       - 'arn:aws:glacier:{{ aws_region }}:{{ aws_account_id }}:vaults/*'
-      - 'arn:aws:redshift:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
-      - 'arn:aws:redshift:{{ aws_region }}:{{ aws_account_id }}:subnetgroup:*'
-      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:subgrp:*'
       - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
-      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:db:*'
-      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:pg:*'
       - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:cluster-pg:*'
+      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:cluster-snapshot:*'
+      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:db:*'
       - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:og:*'
-      - 'arn:aws:dms:{{ aws_region }}:{{ aws_account_id }}:endpoint:*'
+      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:pg:*'
       - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:snapshot:*'
-      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:cluster-snapshot:*'
+      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:subgrp:*'
+      - 'arn:aws:redshift:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
+      - 'arn:aws:redshift:{{ aws_region }}:{{ aws_account_id }}:subnetgroup:*'
   - Sid: AllowGlobalRestrictedResourceActionsWhichIncurFees
     Effect: Allow
     Action:
-      - rds:CreateDBCluster
       - elasticache:CreateCacheCluster
+      - rds:CreateDBCluster
       - redshift:CreateCluster
     Resource:
-      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
-      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:subgrp:*'
       - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
-      - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:subnetgroup:*'
       - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:parametergroup:*'
       - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:securitygroup:*'
+      - 'arn:aws:elasticache:{{ aws_region }}:{{ aws_account_id }}:subnetgroup:*'
+      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
+      - 'arn:aws:rds:{{ aws_region }}:{{ aws_account_id }}:subgrp:*'
       - 'arn:aws:redshift:{{ aws_region }}:{{ aws_account_id }}:cluster:*'
   # This allows AWS Services to autmatically create their Default Service Linked Roles
   # These have fixed policies and can only be assumed by the service itself.
@@ -163,8 +162,8 @@ Statement:
       - kafka:Describe*
       - kafka:Get*
       - kafka:List*
-      - kafka:TagResource
       - kafka:RebootBroker
+      - kafka:TagResource
       - kafka:UntagResource
       - kafka:UpdateBrokerCount
       - kafka:UpdateBrokerStorage