storage-services.yaml

Version: "2012-10-17"
Statement:
  - Sid: AllowGlobalUnrestrictedResourceActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - s3:CreateAccessPoint*
      - s3:CreateBucket
      - s3:DeleteAccessPoint*
      - s3:DeleteBucket
      - s3:DeleteBucketOwnershipControls
      - s3:DeleteObject
      - s3:DeleteObjects
      - s3:DeleteObjectTagging
      - s3:DeleteObjectVersion
      - s3:DeleteObjectVersionTagging
      - s3:Get*
      - s3:HeadBucket
      - s3:HeadObject
      - s3:List*
      - s3:PutAccelerateConfiguration
      - s3:PutBucketAcl
      - s3:PutBucketLogging
      - s3:PutBucketNotification
      - s3:PutBucketObjectLockConfiguration
      - s3:PutBucketOwnershipControls
      - s3:PutBucketPolicy
      - s3:PutBucketPublicAccessBlock
      - s3:PutBucketRequestPayment
      - s3:PutBucketTagging
      - s3:PutBucketVersioning
      - s3:PutEncryptionConfiguration
      - s3:PutInventoryConfiguration
      - s3:PutLifecycleConfiguration
      - s3:PutObject
      - s3:PutObjectAcl
      - s3:PutObjectTagging
      - s3:PutObjectVersionTagging
      - s3:PutReplicationConfiguration
      - elasticfilesystem:CreateFileSystem
      - elasticfilesystem:CreateMountTarget
      - elasticfilesystem:CreateTags
      - elasticfilesystem:DeleteFileSystem
      - elasticfilesystem:DeleteMountTarget
      - elasticfilesystem:Describe*
      - elasticfilesystem:List*
      - elasticfilesystem:PutLifecycleConfiguration
      - elasticfilesystem:TagResource
      - elasticfilesystem:UntagResource
      - elasticfilesystem:UpdateFileSystem
      - backup:CreateBackupPlan
      - backup:CreateBackupSelection
      - backup:CreateBackupVault
      - backup:DeleteBackupPlan
      - backup:DeleteBackupSelection
      - backup:DeleteBackupVault
      - backup:Describe*
      - backup:GetBackup*
      - backup:List*
      - backup:TagResource
      - backup:UntagResource
      - backup:UpdateBackupPlan
      - backup-storage:MountCapsule
      - memorydb:Describe*
      - memorydb:List*
    Resource: "*"

  - Sid: AllowGlobalUnrestrictedResourceActionsWhichIncurFees
    Effect: Allow
    Action:
      - s3:PutMetricsConfiguration
    Resource: "*"

  - Sid: AllowRegionalRestrictedResourceActionsWhichIncurFees
    Effect: Allow
    Action:
      - memorydb:CreateCluster
      - memorydb:CreateSnapshot
    Resource: "*"
    Condition:
      StringEquals:
        aws:RequestedRegion:
          - '{{ aws_region }}'

  - Sid: AllowRegionalRestrictedResourceActionsWhichIncurNoFees
    Effect: Allow
    Action:
      - memorydb:CreateParameterGroup
      - memorydb:CreateSubnetGroup
      - memorydb:CreateUser
      - memorydb:CreateACL
      - memorydb:DeleteACL
      - memorydb:DeleteCluster
      - memorydb:DeleteParameterGroup
      - memorydb:DeleleSnapshot
      - memorydb:DeleteSubnetGroup
      - memorydb:DeleteUser
      - memorydb:TagResource
    Resource:
      - 'arn:aws:memorydb:{{ aws_region }}:{{ aws_account_id }}:*'