Skip to content

Commit dc2a306

Browse files
greg-the-codergreg-the-coder
committed
added custom role/policy for ec2-based templates
1 parent 6573a1f commit dc2a306

File tree

1 file changed

+178
-0
lines changed

1 file changed

+178
-0
lines changed

‎workshop/scripts/coder-workshop-ec2-workspace-role.sh

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
#!/bin/bash
2+
3+
# Script to create IAM role for coder workshop with resource limits
4+
# Role name: coder-workshop-ec2-workspace-role
5+
# Features: Serverless development, Bedrock integration, resource limits
6+
# Restriction: No EC2 instance deployment capability
7+
8+
set -e # Exit on any error
9+
10+
ROLE_NAME="coder-workshop-ec2-workspace-role"
11+
INSTANCE_PROFILE_NAME="coder-workshop-ec2-workspace-profile"
12+
POLICY_NAME="CoderWorkshopResourceLimitedPolicy"
13+
14+
echo "Creating IAM role: $ROLE_NAME"
15+
16+
# Step 1: Create the IAM role with trust policy for EC2
17+
aws iam create-role \
18+
--role-name $ROLE_NAME \
19+
--assume-role-policy-document '{
20+
"Version": "2012-10-17",
21+
"Statement": [
22+
{
23+
"Effect": "Allow",
24+
"Principal": {
25+
"Service": "ec2.amazonaws.com"
26+
},
27+
"Action": "sts:AssumeRole"
28+
}
29+
]
30+
}' \
31+
--description "IAM role for coder workshop with serverless development and Bedrock integration, no EC2 deployment"
32+
33+
echo "IAM role created successfully"
34+
35+
# Step 2: Create and attach comprehensive custom policy with resource limits
36+
echo "Creating and attaching custom policy with resource limits"
37+
38+
aws iam put-role-policy \
39+
--role-name $ROLE_NAME \
40+
--policy-name $POLICY_NAME \
41+
--policy-document '{
42+
"Version": "2012-10-17",
43+
"Statement": [
44+
{
45+
"Sid": "DenyEC2InstanceDeployment",
46+
"Effect": "Deny",
47+
"Action": [
48+
"ec2:RunInstances",
49+
"ec2:StartInstances"
50+
],
51+
"Resource": "*"
52+
},
53+
{
54+
"Sid": "LimitedLambdaAccess",
55+
"Effect": "Allow",
56+
"Action": [
57+
"lambda:CreateFunction",
58+
"lambda:UpdateFunctionCode",
59+
"lambda:UpdateFunctionConfiguration",
60+
"lambda:InvokeFunction",
61+
"lambda:GetFunction",
62+
"lambda:ListFunctions",
63+
"lambda:DeleteFunction",
64+
"lambda:GetFunctionConfiguration",
65+
"lambda:CreateEventSourceMapping",
66+
"lambda:DeleteEventSourceMapping",
67+
"lambda:GetEventSourceMapping",
68+
"lambda:ListEventSourceMappings"
69+
],
70+
"Resource": "*",
71+
"Condition": {
72+
"NumericLessThan": {
73+
"lambda:FunctionCount": "50"
74+
}
75+
}
76+
},
77+
{
78+
"Sid": "LimitedS3Access",
79+
"Effect": "Allow",
80+
"Action": [
81+
"s3:CreateBucket",
82+
"s3:GetObject",
83+
"s3:PutObject",
84+
"s3:DeleteObject",
85+
"s3:ListBucket",
86+
"s3:GetBucketLocation",
87+
"s3:GetBucketVersioning",
88+
"s3:PutBucketVersioning",
89+
"s3:GetBucketPolicy",
90+
"s3:PutBucketPolicy"
91+
],
92+
"Resource": "*",
93+
"Condition": {
94+
"NumericLessThan": {
95+
"s3:BucketCount": "20"
96+
}
97+
}
98+
},
99+
{
100+
"Sid": "LimitedDynamoDBAccess",
101+
"Effect": "Allow",
102+
"Action": [
103+
"dynamodb:CreateTable",
104+
"dynamodb:DeleteTable",
105+
"dynamodb:DescribeTable",
106+
"dynamodb:GetItem",
107+
"dynamodb:PutItem",
108+
"dynamodb:UpdateItem",
109+
"dynamodb:DeleteItem",
110+
"dynamodb:Query",
111+
"dynamodb:Scan",
112+
"dynamodb:BatchGetItem",
113+
"dynamodb:BatchWriteItem",
114+
"dynamodb:ListTables"
115+
],
116+
"Resource": "*",
117+
"Condition": {
118+
"NumericLessThan": {
119+
"dynamodb:TableCount": "25"
120+
}
121+
}
122+
},
123+
{
124+
"Sid": "LimitedAPIGatewayAccess",
125+
"Effect": "Allow",
126+
"Action": [
127+
"apigateway:GET",
128+
"apigateway:POST",
129+
"apigateway:PUT",
130+
"apigateway:DELETE",
131+
"apigateway:PATCH"
132+
],
133+
"Resource": "*",
134+
"Condition": {
135+
"NumericLessThan": {
136+
"apigateway:ApiCount": "10"
137+
}
138+
}
139+
},
140+
{
141+
"Sid": "BedrockAccess",
142+
"Effect": "Allow",
143+
"Action": [
144+
"bedrock:InvokeModel",
145+
"bedrock:InvokeModelWithResponseStream",
146+
"bedrock:ListFoundationModels",
147+
"bedrock:GetFoundationModel",
148+
"bedrock:CreateKnowledgeBase",
149+
"bedrock:GetKnowledgeBase",
150+
"bedrock:ListKnowledgeBases",
151+
"bedrock:CreateDataSource",
152+
"bedrock:GetDataSource",
153+
"bedrock:ListDataSources"
154+
],
155+
"Resource": "*"
156+
},
157+
{
158+
"Sid": "CloudWatchLogsAccess",
159+
"Effect": "Allow",
160+
"Action": [
161+
"logs:CreateLogGroup",
162+
"logs:CreateLogStream",
163+
"logs:PutLogEvents",
164+
"logs:DescribeLogGroups",
165+
"logs:DescribeLogStreams"
166+
],
167+
"Resource": "*"
168+
},
169+
{
170+
"Sid": "IAMPassRoleForLambda",
171+
"Effect": "Allow",
172+
"Action": "iam:PassRole",
173+
"Resource": "arn:aws:iam::*:role/lambda-*"
174+
}
175+
]
176+
}'
177+
178+
echo "Custom policy attached successfully"

0 commit comments

Comments
 (0)