1482127 - Add cross IAM permissions for the CEP to access Kinesis and CloudWatch

Status: RESOLVED FIXED

(Data Platform and Tools :: General, enhancement, P1)

Comment 1

[Mike Trinkala [:trink]]

# Dev
arn:aws:iam::554708791447:role/cep-crossiam-kinesis # devsvcdev
trust: arn:aws:iam::927034868273:role/logging/logging-cep-resources-dev-default-AppRole-114B0PT3L8VIN

# Stage
arn:aws:iam::736049439158:role/cep-crossiam-kinesis # devsvcstage
trust: arn:aws:iam::142069644989:role/logging/logging-cep-resources-stage-default-AppRole-10HYK2T0R9L7Y

# Prod
arn:aws:iam::132922822692:role/cep-crossiam-kinesis # devsvcprod
arn:aws:iam::178550527431:role/cep-crossiam-kinesis # data
trust: arn:aws:iam::361527076523:role/logging/logging-cep-resources-prod-default-AppRole-1H5YQQ0OXJ74J
trust: arn:aws:iam::361527076523:role/logging/logging-cep-resources-prod-test-AppRole-1EBDHNUY03XMH

# Inline Policy KinesisLoggingReadOnly 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "kinesis:SubscribeToShard",
                "kinesis:DescribeStreamSummary",
                "kinesis:DescribeStreamConsumer",
                "kinesis:GetShardIterator",
                "kinesis:GetRecords",
                "kinesis:DescribeStream",
                "kinesis:ListTagsForStream"
            ],
            "Resource": "arn:aws:kinesis:*:ACCT#:stream/logging.*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "kinesis:ListStreams",
                "kinesis:ListShards",
                "kinesis:DescribeLimits",
                "kinesis:ListStreamConsumers"
            ],
            "Resource": "*"
        }
    ]
}

# Inline Policy - CloudWatch
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:PutMetricData"
            ],
            "Resource": "*"
        }
    ]
}