community.aws.iam_policy – Manage inline IAM policies for users, groups, and roles

• Synopsis
• Requirements
• Parameters
• Notes
• Examples

Synopsis

• Allows uploading or removing inline IAM policies for IAM users, groups or roles.
• To administer managed policies please see community.aws.iam_user, community.aws.iam_role, community.aws.iam_group and community.aws.iam_managed_policy

Requirements

The below requirements are needed on the host that executes this module.

• python >= 2.6
• boto

Parameters

Notes

Examples

# Create a policy with the name of 'Admin' to the group 'administrators'
- name: Assign a policy called Admin to the administrators group
  community.aws.iam_policy:
    iam_type: group
    iam_name: administrators
    policy_name: Admin
    state: present
    policy_document: admin_policy.json

# Advanced example, create two new groups and add a READ-ONLY policy to both
# groups.
- name: Create Two Groups, Mario and Luigi
  community.aws.iam:
    iam_type: group
    name: "{{ item }}"
    state: present
  loop:
     - Mario
     - Luigi
  register: new_groups

- name: Apply READ-ONLY policy to new groups that have been recently created
  community.aws.iam_policy:
    iam_type: group
    iam_name: "{{ item.created_group.group_name }}"
    policy_name: "READ-ONLY"
    policy_document: readonlypolicy.json
    state: present
  loop: "{{ new_groups.results }}"

# Create a new S3 policy with prefix per user
- name: Create S3 policy from template
  community.aws.iam_policy:
    iam_type: user
    iam_name: "{{ item.user }}"
    policy_name: "s3_limited_access_{{ item.prefix }}"
    state: present
    policy_json: " {{ lookup( 'template', 's3_policy.json.j2') }} "
    loop:
      - user: s3_user
        prefix: s3_user_prefix

Authors

• Jonathan I. Davila (@defionscode)
• Dennis Podkovyrin (@sbj-ss)