willafan / aws

aws

aws's Issues

Test policies plan

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_managed-policies.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html

Blocker get started to create an Amazon OpenSearch domain

https://docs.aws.amazon.com/opensearch-service/latest/developerguide/gsgcreate-domain.html

resources

Region	Status	Action
Africa (Cape Town)	Disabled	Enable
Asia Pacific (Hong Kong)	Disabled	Enable
Asia Pacific (Hyderabad)	Disabled	Enable
Asia Pacific (Jakarta)	Disabled	Enable
Europe (Zurich)	Disabled	Enable
Europe (Milan)	Disabled	Enable
Europe (Spain)	Disabled	Enable
Middle East (UAE)	Disabled	Enable
Middle East (Bahrain)	Disabled	Enable
US West (Oregon)	Enabled by default
US West (N. California)	Enabled by default
US East (Ohio)	Enabled by default
US East (N. Virginia)	Enabled by default
South America (São Paulo)	Enabled by default
Europe (Paris)	Enabled by default
Europe (London)	Enabled by default
Europe (Ireland)	Enabled by default
Europe (Stockholm)	Enabled by default
Europe (Frankfurt)	Enabled by default
Canada (Central)	Enabled by default
Asia Pacific (Sydney)	Enabled by default
Asia Pacific (Singapore)	Enabled by default
Asia Pacific (Mumbai)	Enabled by default
Asia Pacific (Osaka)	Enabled by default
Asia Pacific (Seoul)	Enabled by default
Asia Pacific (Tokyo)	Enabled by default

FYR. Creating an environment with code

AWS CLI	create-environment-ec2
AWS SDK for C++	CreateEnvironmentEC2Request

AWS CLI

create-environment-ec2

AWS SDK for C++

CreateEnvironmentEC2Request
, CreateEnvironmentEC2Result

AWS SDK for Go

CreateEnvironmentEC2, CreateEnvironmentEC2Request, CreateEnvironmentEC2WithContext

AWS SDK for Java

CreateEnvironmentEC2Request, CreateEnvironmentEC2Result

AWS SDK for JavaScript

createEnvironmentEC2

AWS SDK for .NET

CreateEnvironmentEC2Request, CreateEnvironmentEC2Response

AWS SDK for PHP

createEnvironmentEC2

AWS SDK for Python (Boto)

create_environment_ec2

AWS SDK for Ruby

create_environment_ec2

AWS Tools for Windows PowerShell

New-C9EnvironmentEC2

AWS Cloud9 API

CreateEnvironmentEC2

Quickstart for GitHub Issues

https://docs.github.com/en/issues/tracking-your-work-with-issues/quickstart

Policy merge

anyService-linkedRole
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam:::role/aws-service-role/"
}
]
}

Official policy statement
AmazonEC2FullAccess
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "ec2:",
"Effect": "Allow",
"Resource": ""
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:",
"Resource": ""
},
{
"Effect": "Allow",
"Action": "cloudwatch:",
"Resource": ""
},
{
"Effect": "Allow",
"Action": "autoscaling:",
"Resource": ""
},
{
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"autoscaling.amazonaws.com",
"ec2scheduled.amazonaws.com",
"elasticloadbalancing.amazonaws.com",
"spot.amazonaws.com",
"spotfleet.amazonaws.com",
"transitgateway.amazonaws.com"
]
}
}
}
]
}

AWSCloud9EnvironmentMember
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloud9:GetUserSettings",
"cloud9:UpdateUserSettings",
"iam:GetUser",
"iam:ListUsers"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"cloud9:DescribeEnvironmentMemberships"
],
"Resource": [
""
],
"Condition": {
"Null": {
"cloud9:UserArn": "true",
"cloud9:EnvironmentId": "true"
}
}
},
{
"Effect": "Allow",
"Action": "ssm:StartSession",
"Resource": "arn:aws:ec2:::instance/",
"Condition": {
"StringLike": {
"ssm:resourceTag/aws:cloud9:environment": ""
},
"StringEquals": {
"aws:CalledViaFirst": "cloud9.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:StartSession"
],
"Resource": [
"arn:aws:ssm:::document/*"
]
}
]
}

AWSSecurityHubReadOnlyAccess
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"securityhub:Get*",
"securityhub:List*",
"securityhub:BatchGet*",
"securityhub:Describe*"
],
"Resource": "*"
}
]
}

AWSCloud9Administrator
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloud9:",
"iam:GetUser",
"iam:ListUsers",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "",
"Condition": {
"StringLike": {
"iam:AWSServiceName": "cloud9.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": "ssm:StartSession",
"Resource": "arn:aws:ec2:::instance/",
"Condition": {
"StringLike": {
"ssm:resourceTag/aws:cloud9:environment": ""
},
"StringEquals": {
"aws:CalledViaFirst": "cloud9.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:StartSession"
],
"Resource": [
"arn:aws:ssm:::document/"
]
}
]
}

AWSCloud9User
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloud9:ValidateEnvironmentName",
"cloud9:UpdateUserSettings",
"cloud9:GetUserSettings",
"iam:GetUser",
"iam:ListUsers",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"cloud9:CreateEnvironmentEC2",
"cloud9:CreateEnvironmentSSH"
],
"Resource": "",
"Condition": {
"Null": {
"cloud9:OwnerArn": "true"
}
}
},
{
"Effect": "Allow",
"Action": [
"cloud9:GetUserPublicKey"
],
"Resource": "",
"Condition": {
"Null": {
"cloud9:UserArn": "true"
}
}
},
{
"Effect": "Allow",
"Action": [
"cloud9:DescribeEnvironmentMemberships"
],
"Resource": [
""
],
"Condition": {
"Null": {
"cloud9:UserArn": "true",
"cloud9:EnvironmentId": "true"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "",
"Condition": {
"StringLike": {
"iam:AWSServiceName": "cloud9.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": "ssm:StartSession",
"Resource": "arn:aws:ec2:::instance/",
"Condition": {
"StringLike": {
"ssm:resourceTag/aws:cloud9:environment": ""
},
"StringEquals": {
"aws:CalledViaFirst": "cloud9.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:StartSession"
],
"Resource": [
"arn:aws:ssm:::document/"
]
}
]
}

AmazonLaunchWizard_Fullaccess
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "applicationinsights:",
"Resource": ""
},
{
"Effect": "Allow",
"Action": "resource-groups:List*",
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets",
"route53:GetChange",
"route53:ListResourceRecordSets",
"route53:ListHostedZones",
"route53:ListHostedZonesByName"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"kms:ListKeys",
"kms:ListAliases"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:List*",
"cloudwatch:Get*",
"cloudwatch:Describe*"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateInternetGateway",
"ec2:CreateNatGateway",
"ec2:CreateVpc",
"ec2:CreateKeyPair",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress",
"ec2:AllocateHosts",
"ec2:AssignPrivateIpAddresses",
"ec2:AssociateAddress",
"ec2:CreateDhcpOptions",
"ec2:CreateEgressOnlyInternetGateway",
"ec2:CreateNetworkInterface",
"ec2:CreateVolume",
"ec2:CreateVpcEndpoint",
"ec2:CreateTags",
"ec2:DeleteTags",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVolumeAttribute",
"ec2:ModifyVpcAttribute",
"ec2:AssociateDhcpOptions",
"ec2:AssociateSubnetCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachNetworkInterface",
"ec2:AttachVolume",
"ec2:DeleteDhcpOptions",
"ec2:DeleteInternetGateway",
"ec2:DeleteKeyPair",
"ec2:DeleteNatGateway",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DetachVolume",
"ec2:DeleteSnapshot",
"ec2:AssociateRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkInterface",
"ec2:DeleteNetworkInterfacePermission",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DetachNetworkInterface",
"ec2:DisassociateAddress",
"ec2:DisassociateVpcCidrBlock",
"ec2:GetLaunchTemplateData",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:ModifyVolume",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:GetConsoleOutput",
"ec2:GetPasswordData",
"ec2:ReleaseAddress",
"ec2:ReplaceRoute",
"ec2:ReplaceRouteTableAssociation",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:DisassociateIamInstanceProfile",
"ec2:DisassociateRouteTable",
"ec2:DisassociateSubnetCidrBlock",
"ec2:ModifyInstancePlacement",
"ec2:DeletePlacementGroup",
"ec2:CreatePlacementGroup",
"elasticfilesystem:DeleteFileSystem",
"elasticfilesystem:DeleteMountTarget",
"ds:AddIpRoutes",
"ds:CreateComputer",
"ds:CreateMicrosoftAD",
"ds:DeleteDirectory",
"servicecatalog:AssociateProductWithPortfolio",
"cloudformation:GetTemplateSummary",
"sts:GetCallerIdentity"
],
"Resource": "",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStack",
"cloudformation:Get*",
"cloudformation:ListStacks",
"cloudformation:SignalResource",
"cloudformation:DeleteStack"
],
"Resource": [
"arn:aws:cloudformation:::stack/LaunchWizard*/",
"arn:aws:cloudformation:::stack/ApplicationInsights/"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:StopInstances",
"ec2:TerminateInstances"
],
"Resource": "",
"Condition": {
"StringLike": {
"ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:::stack/LaunchWizard-/"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Resource": [
"arn:aws:iam:::role/service-role/AmazonEC2RoleForLaunchWizard",
"arn:aws:iam:::instance-profile/LaunchWizard"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam:::role/service-role/AmazonEC2RoleForLaunchWizard",
"arn:aws:iam:::role/service-role/AmazonLambdaRoleForLaunchWizard",
"arn:aws:iam:::instance-profile/LaunchWizard"
],
"Condition": {
"StringEqualsIfExists": {
"iam:PassedToService": [
"lambda.amazonaws.com",
"ec2.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"autoscaling:AttachInstances",
"autoscaling:CreateAutoScalingGroup",
"autoscaling:CreateLaunchConfiguration",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:DeleteLaunchConfiguration",
"autoscaling:UpdateAutoScalingGroup",
"logs:CreateLogStream",
"logs:DeleteLogGroup",
"logs:DeleteLogStream",
"logs:DescribeLog*",
"logs:PutLogEvents",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"sns:ListSubscriptionsByTopic",
"sns:Publish",
"ssm:DeleteDocument",
"ssm:DeleteParameter*",
"ssm:DescribeDocument*",
"ssm:GetDocument",
"ssm:PutParameter"
],
"Resource": [
"arn:aws:resource-groups:::group/LaunchWizard*",
"arn:aws:sns:::",
"arn:aws:autoscaling:::autoScalingGroup::autoScalingGroupName/LaunchWizard*",
"arn:aws:autoscaling:::launchConfiguration::launchConfigurationName/LaunchWizard",
"arn:aws:ssm:::parameter/LaunchWizard*",
"arn:aws:ssm:::document/LaunchWizard*",
"arn:aws:logs:::log-group:::",
"arn:aws:logs:::log-group:LaunchWizard"
]
},
{
"Effect": "Allow",
"Action": [
"ssm:GetDocument",
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ssm:::document/AWS-RunShellScript"
]
},
{
"Effect": "Allow",
"Action": [
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ec2:::instance/"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:::stack/LaunchWizard-/"
}
}
},
{
"Effect": "Allow",
"Action": [
"logs:DeleteLogStream",
"logs:GetLogEvents",
"logs:PutLogEvents",
"ssm:AddTagsToResource",
"ssm:DescribeDocument",
"ssm:GetDocument",
"ssm:ListTagsForResource",
"ssm:RemoveTagsFromResource"
],
"Resource": [
"arn:aws:logs:::log-group:::",
"arn:aws:logs:::log-group:LaunchWizard",
"arn:aws:ssm:::parameter/LaunchWizard*",
"arn:aws:ssm:::document/LaunchWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:Describe*",
"cloudformation:DescribeAccountLimits",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:List*",
"cloudformation:ValidateTemplate",
"ds:Describe*",
"ds:ListAuthorizedApplications",
"ec2:Describe*",
"ec2:Get*",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetUser",
"iam:GetPolicyVersion",
"iam:GetPolicy",
"iam:List*",
"logs:CreateLogGroup",
"logs:GetLogDelivery",
"logs:GetLogRecord",
"logs:ListLogDeliveries",
"resource-groups:Get*",
"resource-groups:List*",
"servicequotas:GetServiceQuota",
"servicequotas:ListServiceQuotas",
"sns:ListSubscriptions",
"sns:ListTopics",
"ssm:CreateDocument",
"ssm:DescribeAutomation*",
"ssm:DescribeInstanceInformation",
"ssm:DescribeParameters",
"ssm:GetAutomationExecution",
"ssm:GetCommandInvocation",
"ssm:GetParameter*",
"ssm:GetConnectionStatus",
"ssm:ListCommand*",
"ssm:ListDocument*",
"ssm:ListInstanceAssociations",
"ssm:SendAutomationSignal",
"tag:Get*"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"ssm:StartAutomationExecution",
"ssm:StopAutomationExecution"
],
"Resource": "arn:aws:ssm:::automation-definition/LaunchWizard-:",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": "logs:GetLog",
"Resource": [
"arn:aws:logs:::log-group:::",
"arn:aws:logs:::log-group:LaunchWizard"
]
},
{
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*"
],
"Resource": "arn:aws:cloudformation:::stack/LaunchWizard*/"
},
{
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"autoscaling.amazonaws.com",
"application-insights.amazonaws.com",
"events.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": "launchwizard:",
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"sqs:TagQueue",
"sqs:GetQueueUrl",
"sqs:AddPermission",
"sqs:ListQueues",
"sqs:DeleteQueue",
"sqs:GetQueueAttributes",
"sqs:ListQueueTags",
"sqs:CreateQueue",
"sqs:SetQueueAttributes"
],
"Resource": "arn:aws:sqs:::LaunchWizard"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:PutMetricAlarm",
"iam:GetInstanceProfile",
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms"
],
"Resource": [
"arn:aws:cloudwatch:::alarm:LaunchWizard*",
"arn:aws:iam:::instance-profile/LaunchWizard"
]
},
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"route53:ListHostedZones",
"ec2:CreateSecurityGroup",
"ec2:AuthorizeSecurityGroupIngress",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:CreateFileSystem",
"elasticfilesystem:CreateMountTarget",
"elasticfilesystem:DescribeMountTargets",
"elasticfilesystem:DescribeMountTargetSecurityGroups"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::launchwizard",
"arn:aws:s3:::launchwizard*/",
"arn:aws:s3:::aws-sap-data-provider/config.properties"
]
},
{
"Effect": "Allow",
"Action": "cloudformation:TagResource",
"Resource": "",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "LaunchWizard*"
}
}
},
{
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:PutBucketVersioning",
"s3:DeleteBucket",
"lambda:CreateFunction",
"lambda:DeleteFunction",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:InvokeFunction"
],
"Resource": [
"arn:aws:lambda:::function:LaunchWizard*",
"arn:aws:s3:::launchwizard*"
]
},
{
"Effect": "Allow",
"Action": [
"dynamodb:CreateTable",
"dynamodb:DescribeTable",
"dynamodb:DeleteTable"
],
"Resource": "arn:aws:dynamodb:::table/LaunchWizard*"
},
{
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:TagResource",
"secretsmanager:UntagResource",
"secretsmanager:PutResourcePolicy",
"secretsmanager:DeleteResourcePolicy",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:GetSecretValue"
],
"Resource": "arn:aws:secretsmanager::㊙️LaunchWizard*"
},
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetRandomPassword",
"secretsmanager:ListSecrets"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"ssm:CreateOpsMetadata"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": "ssm:DeleteOpsMetadata",
"Resource": "arn:aws:ssm:::opsmetadata/aws/ssm/LaunchWizard*"
},
{
"Effect": "Allow",
"Action": [
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:Subscribe",
"sns:Unsubscribe"
],
"Resource": "arn:aws:sns:::LaunchWizard*"
},
{
"Effect": "Allow",
"Action": [
"fsx:UntagResource",
"fsx:TagResource",
"fsx:DeleteFileSystem",
"fsx:ListTagsForResource"
],
"Resource": "",
"Condition": {
"StringLike": {
"aws:ResourceTag/Name": "LaunchWizard"
}
}
},
{
"Effect": "Allow",
"Action": [
"fsx:CreateFileSystem"
],
"Resource": "",
"Condition": {
"StringLike": {
"aws:RequestTag/Name": [
"LaunchWizard"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"fsx:DescribeFileSystems"
],
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"servicecatalog:CreatePortfolio",
"servicecatalog:DescribePortfolio",
"servicecatalog:CreateConstraint",
"servicecatalog:CreateProduct",
"servicecatalog:AssociatePrincipalWithPortfolio",
"servicecatalog:CreateProvisioningArtifact"
],
"Resource": [
"arn:aws:servicecatalog:::/",
"arn:aws:catalog:::/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
}
]
}

AmazonOpenSearchServiceFullAccess
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"es:"
],
"Resource": ""
}
]
}

AmazonOpenSearchServiceCognitoAccess
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cognito-idp:DescribeUserPool",
"cognito-idp:CreateUserPoolClient",
"cognito-idp:DeleteUserPoolClient",
"cognito-idp:UpdateUserPoolClient",
"cognito-idp:DescribeUserPoolClient",
"cognito-idp:AdminInitiateAuth",
"cognito-idp:AdminUserGlobalSignOut",
"cognito-idp:ListUserPoolClients",
"cognito-identity:DescribeIdentityPool",
"cognito-identity:UpdateIdentityPool",
"cognito-identity:GetIdentityPoolRoles"
],
"Resource": [
"arn:aws:cognito-identity:::identitypool/",
"arn:aws:cognito-idp:::userpool/"
]
},
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam:::role/",
"Condition": {
"StringLike": {
"iam:PassedToService": [
"cognito-identity.amazonaws.com",
"cognito-identity-us-gov.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": "cognito-identity:SetIdentityPoolRoles",
"Resource": "*"
}
]
}

AWSQuicksightOpenSearchPolicy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"es:ESHttpGet"
],
"Resource": [
"arn:aws:es:::domain//",
"arn:aws:es:::domain//_cluster/settings",
"arn:aws:es:::domain//_cat/indices"
]
},
{
"Effect": "Allow",
"Action": "es:ListDomainNames",
"Resource": ""
},
{
"Effect": "Allow",
"Action": [
"es:DescribeDomain"
],
"Resource": [
"arn:aws:es:::domain/"
]
},
{
"Effect": "Allow",
"Action": [
"es:ESHttpPost",
"es:ESHttpGet"
],
"Resource": [
"arn:aws:es:::domain//_opendistro/_sql",
"arn:aws:es:::domain/*/_plugin/_sql"
]
}
]
}

Error launch ec2 instance following guide from the beginning

phase 1 task list

arrive at aws each work day, perform following suggested tasks

• Check health (such as ADMIN user groups, users, permissions;

• Amazon OpenSearch Service;

• All account environments configuration on cloud9;

• Figure out ambiguity in EC2 environment, EC2 instance and server)

• to be finished Step 2: Upload data for indexing

# Importants

Policy #7