Skip to main content
Skip table of contents

Minimal IAM Permissions for KIB

Configure IAM Prerequisites before building an AWS Image

This section guides you in creating and using a minimally-scoped policy to create an Image for an AWS account using Konvoy Image Builder.

Prerequisites

Before applying the IAM Policies, verify the following:

Minimal Permissions

The following is an AWSCloudformation stack that creates the minimal policy to run KIB in AWS.

  1. Copy the following contents into a file:

CODE
AWSTemplateFormatVersion: 2010-09-09
Resources:
  AWSIAMInstanceKIBUser:
    Properties:
      InstanceProfileName: KIBUserInstnaceProfile
      Roles:
        - Ref: KIBUserRole
    Type: AWS::IAM::InstanceProfile
  AWSIAMManagedPolicyKIBPolicy:
    Properties:
      Description: Minimal policy to run KIB in AWS
      ManagedPolicyName: kib-policy
      PolicyDocument:
        Statement:
          - Action:
              - ec2:AssociateRouteTable
              - ec2:AssociateRouteTable
              - ec2:AttachInternetGateway
              - ec2:AttachVolume
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:CreateImage
              - ec2:CreateInternetGateway
              - ec2:CreateKeyPair
              - ec2:CreateRoute
              - ec2:CreateRouteTable
              - ec2:CreateSecurityGroup
              - ec2:CreateSubnet
              - ec2:CreateTags
              - ec2:CreateVolume
              - ec2:CreateVpc
              - ec2:DeleteInternetGateway
              - ec2:DeleteKeyPair
              - ec2:DeleteRouteTable
              - ec2:DeleteSecurityGroup
              - ec2:DeleteSnapshot
              - ec2:DeleteSubnet
              - ec2:DeleteVolume
              - ec2:DeleteVpc
              - ec2:DeregisterImage
              - ec2:DescribeAccountAttributes
              - ec2:DescribeImages
              - ec2:DescribeInstances
              - ec2:DescribeInternetGateways
              - ec2:DescribeKeyPairs
              - ec2:DescribeNetworkAcls
              - ec2:DescribeNetworkInterfaces
              - ec2:DescribeRegions
              - ec2:DescribeRouteTables
              - ec2:DescribeSecurityGroups
              - ec2:DescribeSubnets
              - ec2:DescribeVolume
              - ec2:DescribeVpcAttribute
              - ec2:DescribeVpcClassicLink
              - ec2:DescribeVpcClassicLinkDnsSupport
              - ec2:DescribeVpcs
              - ec2:DetachInternetGateway
              - ec2:DetachVolume
              - ec2:DisassociateRouteTable
              - ec2:ModifyImageAttribute
              - ec2:ModifySnapshotAttribute
              - ec2:ModifySubnetAttribute
              - ec2:ModifyVpcAttribute
              - ec2:RegisterImage
              - ec2:RevokeSecurityGroupEgress
              - ec2:RunInstances
              - ec2:StopInstances
              - ec2:TerminateInstances
            Effect: Allow
            Resource:
              - '*'
        Version: 2012-10-17
      Roles:
        - Ref: KIBUserRole
    Type: AWS::IAM::ManagedPolicy
    Version: 2012-10-17
  KIBUserRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              AWS: arn:aws:iam::MYAWSACCOUNTID:root
        Version: 2012-10-17
      RoleName: kib-user-role
    Type: AWS::IAM::Role

2. Replace the following with the correct values:

  • MYFILENAME.yaml - give your file a meaningful name.

  • MYSTACKNAME - give your cloudformation stack a meaningful name.

3. Run the following command to create the stack:

CODE
aws cloudformation create-stack --template-body=file://MYFILENAME.yaml --stack-name=MYSTACKNAME --capabilities  CAPABILITY_NAMED_IAM

Next Step:

AWS Image Integrated with DKP CLI

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.