elastio-stack/iam-policies/terraform/policies/ElastioAwsBackupEc2Scan.json at 8386a8ef64958a739414f7f5bfba618b19ddede1 · elastio/elastio-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
{
  "Description": "Allows Elastio to scan AWS Backup EC2 and EBS recovery points.",
  "PolicyDocument": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "ReadBackupInventory",
        "Action": [
          "backup:ListBackupVaults",
          "backup:DescribeBackupVault",
          "backup:ListRecoveryPointsByResource",
          "backup:DescribeRecoveryPoint",
          "backup:ListRecoveryPointsByBackupVault",
          "backup:GetRecoveryPointRestoreMetadata",
          "backup:ListTags",
          "backup:ListProtectedResources",
          "backup:ListProtectedResourcesByBackupVault"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Sid": "ReadEbsInventory",
        "Action": [
          "ec2:DescribeVolumeStatus",
          "ec2:DescribeVolumes",
          "ec2:DescribeSnapshots",
          "ec2:DescribeSnapshotAttribute",
          "ec2:DescribeTags",
          "ebs:ListSnapshotBlocks",
          "ebs:ListChangedBlocks"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Sid": "ReadEbsSnapshotsData",
        "Action": ["ebs:GetSnapshotBlock"],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Sid": "ReadEc2Inventory",
        "Action": [
          "ec2:DescribeInstances",
          "ec2:DescribeImages",
          "ec2:DescribeHosts",
          "ssm:DescribeInstanceInformation"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Sid": "ShareEbsSnapshot",
        "Action": ["ec2:ModifySnapshotAttribute"],
        "Resource": "*",
        "Condition": {
          "StringLike": {
            "ec2:Add/userId": "*"
          }
        },
        "Effect": "Allow"
      },
      {
        "Sid": "KmsAccess",
        "Condition": {
          "StringLike": {
            "aws:ResourceTag/elastio:authorize": "*"
          }
        },
        "Action": [
          "kms:ReEncryptFrom",
          "kms:ReEncryptTo",
          "kms:CreateGrant",
          "kms:Encrypt",
          "kms:DescribeKey",
          "kms:GenerateDataKey",
          "kms:GenerateDataKeyWithoutPlaintext",
          "kms:Decrypt"
        ],
        "Resource": "*",
        "Effect": "Allow"
      }
    ]
  }
}