Configuring permissions for AWS AppConfig

AWS AppConfig uses the following API actions.

AWS AppConfig resource	API actions
AWS AppConfig applications	CreateApplication, UpdateApplication, DeleteApplication, GetApplication, ListApplications For more information, see Step 1: Creating an AWS AppConfig application
Environments	CreateEnvironment, UpdateEnvironment, DeleteEnvironment, GetEnvironment, ListEnvironments For more information, see Step 2: Creating an environment
Configurations	GetConfiguration For more information, see Step 3: Creating a configuration and a configuration profile
Configuration profiles	CreateConfigurationProfile, UpdateConfigurationProfile, DeleteConfigurationProfile, GetConfigurationProfile, ValidateConfiguration, ListConfigurationProfiles, ValidateConfiguration For more information, see Step 3: Creating a configuration and a configuration profile
Deployment strategies	CreateDeploymentStrategy, UpdateDeploymentStrategy, DeleteDeploymentStrategy, GetDeploymentStrategy, ListDeploymentStrategies, CreateDocument, UpdateDocument, DeleteDocument, GetDocument, ListDocuments For more information, see Step 4: Creating a deployment strategy
Deployments	StartDeployment, StopDeployment, ListDeployments For more information, see Step 5: Deploying a configuration

We recommend that you create restrictive IAM permissions policies that grant users, groups, and roles the least privileges necessary to perform a desired action in AWS AppConfig.

For example, you can create a read-only IAM permissions policy that includes only the Get and List API actions used by AWS AppConfig, like the following.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetDocument",
        "ssm:ListDocuments",
        "appconfig:ListApplications",
        "appconfig:GetApplication",
        "appconfig:ListEnvironments",
        "appconfig:GetEnvironment",
        "appconfig:ListConfigurationProfiles",
        "appconfig:GetConfigurationProfile",
        "appconfig:ListDeploymentStrategies",
        "appconfig:GetDeploymentStrategy",
        "appconfig:GetConfiguration",
        "appconfig:ListDeployments"
               
      ],
      "Resource": "*"
    }
  ]
}

Important

Restrict access to the StartDeployment and StopDeployment API actions to trusted users who understand the responsibilities and consequences of deploying a new configuration to your targets.

For more information about creating and editing IAM policies, see Creating IAM Policies in the IAM User Guide. For information about how to assign this policy to an IAM group, see Attaching a Policy to an IAM Group.

To configure an IAM user account with permission to use AWS AppConfig

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose Users.

3. In the list, choose a name.

4. Choose the Permissions tab.

5. On the right side of the page, under Permission policies, choose Add inline policy.

6. Choose the JSON tab.

7. Replace the default content with your custom permissions policy.

8. Choose Review policy.

9. On the Review policy page, for Name, enter a name for the inline policy. For example: AWS AppConfig-<action>-Access.

10. Choose Create policy.