Security Policy for AWS User

To deploy the vThunder instance using a CFT template, an AWS user requires certain security policies. The following security policies are recommended:

Predefined

• AmazonEC2FullAccess
• AmazonS3FullAccess
• AmazonS3ObjectLambdaExecutionRolePolicy
• AmazonVPCFullAccess

Custom

• Create and Edit Secrets

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "secretsmanager:CreateSecret",
                  "secretsmanager:PutSecretValue"
              ],
              "Resource": "arn:aws:secretsmanager:us-east-1:939850196882:secret:*"
          }
      ]
  }
  

• Lambda Update

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "ConfigureFunctions",
              "Effect": "Allow",
              "Action": [
                  "lambda:UpdateFunctionConfiguration",
                  "lambda:GetFunction"
              ],
              "Resource": "*",
              "Condition": {
                  "ForAllValues:StringLike": {
                      "lambda:Layer": [
                          "arn:aws:lambda:*:939850196882:layer:*:*"
                      ]
                  }
              }
          }
      ]
  }
  

• Manage Secrets

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "secretsmanager:GetResourcePolicy",
                  "secretsmanager:GetSecretValue",
                  "secretsmanager:DescribeSecret",
                  "secretsmanager:ListSecretVersionIds"
              ],
              "Resource": "arn:aws:secretsmanager:us-east-1:939850196882:secret:*"
          },
          {
              "Effect": "Allow",
              "Action": "secretsmanager:ListSecrets",
              "Resource": "*"
          }
      ]
  }
  

• Cloud Watch Logs and Streams

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "secretsmanager:GetResourcePolicy",
                  "secretsmanager:GetSecretValue",
                  "secretsmanager:DescribeSecret",
                  "secretsmanager:ListSecretVersionIds"
              ],
              "Resource": "arn:aws:secretsmanager:us-east-1:939850196882:secret:*"
          },
          {
              "Effect": "Allow",
              "Action": "secretsmanager:ListSecrets",
              "Resource": "*"
          }
      ]
  }