sungardas_es_admin_role_perm_restricted.template

{
   "AWSTemplateFormatVersion": "2010-09-09",
   "Resources": {
      "esadmin": {
         "Type": "AWS::IAM::Role",
         "Properties": {
            "AssumeRolePolicyDocument": {
               "Version" : "2012-10-17",
               "Statement": [ {
                  "Effect": "Allow",
                  "Principal": {
                     "Service": [ "ec2.amazonaws.com" ]
                  },
                  "Action": [ "sts:AssumeRole" ]
               } ]
            },
            "Path": "/"
         }
      },
      "Snapappec2Policy": {
         "Type": "AWS::IAM::ManagedPolicy",
         "Properties": {
            "Description": "Policy for creating es admin role",
            "PolicyDocument": {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Action": [
               "ec2:AttachVolume",
                "ec2:CreateSnapshot",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:DeleteSnapshot",
                "ec2:DeleteTags",
                "ec2:DeleteVolume",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInstances",
                "ec2:TerminateInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeSnapshotAttribute",
                "ec2:DescribeSnapshots",
                "ec2:DescribeTags",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeVolumeStatus",
                "ec2:DescribeVolumes",
                "ec2:DetachVolume",
                "ec2:EnableVolumeIO",
                "ec2:ModifyInstanceAttribute",
                "ec2:ModifySnapshotAttribute",
                "ec2:ModifyVolumeAttribute",
                "ec2:ResetSnapshotAttribute",
		"s3:ListAllMyBuckets",
                "dynamodb:ListTables",
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogStreams"
            ],
            "Resource": "*"
        },
{
            "Sid": "AllowReservedCapacityDescriptions",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeReservedCapacity",
                "dynamodb:DescribeReservedCapacityOfferings"
            ],
            "Resource": "arn:aws:dynamodb:::*"
        },
    {
      "Effect": "Allow",
      "Action": "dynamodb:*",
      "Resource": [	
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/BackupList"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Configurations"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Retention"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Snapshots"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Tasks"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Users"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/BackupList/index/*"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Configurations/index/*"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Retention/index/*"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Snapshots/index/*"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Tasks/index/*"]]},
{"Fn::Join": [":",["arn:aws:dynamodb",{"Ref": "AWS::Region"},{"Ref": "AWS::AccountId"},"table/Users/index/*"]]}

     ],

      "Condition": {}
    },


{
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::com.sungardas.enhancedsnapshots*",
      "Condition": {}
    },
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::com.sungardas.enhancedsnapshots*/*",
      "Condition": {}
    }


    ]
},
            "Roles": [ { "Ref": "esadmin" } ]
         }
      },
      "Snapappec2Profile": {
         "Type": "AWS::IAM::InstanceProfile",
         "Properties": {
            "Path": "/",
            "Roles": [ { "Ref": "esadmin" } ]
         }
      }
   }
}